@node9/policy-engine 2.22.1 → 2.23.0

package/dist/index.d.mts

@@ -1351,7 +1351,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1362,7 +1362,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "ca0a79b38a804347";
+declare const CANONICAL_EXTRACTOR_HASH = "5b2e76537f368d99";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.d.ts

@@ -1351,7 +1351,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1362,7 +1362,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "ca0a79b38a804347";
+declare const CANONICAL_EXTRACTOR_HASH = "5b2e76537f368d99";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.js

@@ -1373,6 +1373,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -2392,6 +2393,60 @@ var NET_BINARIES = /* @__PURE__ */ new Set([
   "rsync"
 ]);
 var VALUE_FLAGS = {
+  // rsync 3.2.7, its own --help: every flag whose operand could be mistaken for
+  // a host. `-e ssh` is the one that matters most (`ssh` is not the destination).
+  rsync: /* @__PURE__ */ new Set([
+    "-e",
+    "--rsh",
+    "-f",
+    "--filter",
+    "-T",
+    "--temp-dir",
+    "-B",
+    "--block-size",
+    "-M",
+    "--remote-option",
+    "--exclude",
+    "--exclude-from",
+    "--include",
+    "--include-from",
+    "--files-from",
+    "--compare-dest",
+    "--copy-dest",
+    "--link-dest",
+    "--partial-dir",
+    "--log-file",
+    "--password-file",
+    "--bwlimit",
+    "--timeout",
+    "--contimeout",
+    "--port",
+    "--sockopts",
+    "--address",
+    "--chmod",
+    "--chown",
+    "--max-size",
+    "--min-size",
+    "--modify-window",
+    "--out-format",
+    "--log-file-format",
+    "--backup-dir",
+    "--suffix",
+    "--iconv",
+    "--max-delete",
+    "--checksum-choice",
+    "--info",
+    "--debug",
+    "--stderr",
+    "--outbuf",
+    "--skip-compress",
+    "--usermap",
+    "--groupmap",
+    "--mkpath",
+    "--write-batch",
+    "--read-batch",
+    "--only-write-batch"
+  ]),
   curl: /* @__PURE__ */ new Set([
     "-d",
     "--data",
@@ -2475,23 +2530,163 @@ var VALUE_FLAGS = {
   ]),
   nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
 };
+var HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+var assignmentTable = null;
+var currentStmtOffset = Number.MAX_SAFE_INTEGER;
+var PAYLOAD_BUDGET = 256;
+var payloadBudget = 0;
+var seenPayloads = null;
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+var UNANALYSABLE_NESTING = {
+  ruleName: "review-unanalysable-nesting",
+  verdict: "review",
+  reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+  path: ""
+};
+var ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+var AND_OP = probeBinOp("a && b");
+var OR_OP = probeBinOp("a || b");
+var AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function parseDestHost(token) {
   if (!token) return null;
   let t = token.trim();
@@ -2546,6 +2741,7 @@ function destTokensForBinary(binary, args) {
     case "ssh":
       return positionals.slice(0, 1);
     case "scp":
+    case "rsync":
       return positionals.filter((p) => p.includes(":") || p.includes("@"));
     case "nc":
     case "ncat":
@@ -2746,17 +2942,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2785,9 +2999,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -2796,7 +3031,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -2811,6 +3046,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -2868,6 +3108,18 @@ function resolveCopyShape(words, h) {
   return null;
 }
 var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -2883,8 +3135,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -3088,6 +3345,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -3169,18 +3435,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -5789,8 +6058,8 @@ function matchCanaryArgs(args, values) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
-var CANONICAL_EXTRACTOR_HASH = "ca0a79b38a804347";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
+var CANONICAL_EXTRACTOR_HASH = "5b2e76537f368d99";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];

package/dist/index.mjs

@@ -1231,6 +1231,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -2250,6 +2251,60 @@ var NET_BINARIES = /* @__PURE__ */ new Set([
   "rsync"
 ]);
 var VALUE_FLAGS = {
+  // rsync 3.2.7, its own --help: every flag whose operand could be mistaken for
+  // a host. `-e ssh` is the one that matters most (`ssh` is not the destination).
+  rsync: /* @__PURE__ */ new Set([
+    "-e",
+    "--rsh",
+    "-f",
+    "--filter",
+    "-T",
+    "--temp-dir",
+    "-B",
+    "--block-size",
+    "-M",
+    "--remote-option",
+    "--exclude",
+    "--exclude-from",
+    "--include",
+    "--include-from",
+    "--files-from",
+    "--compare-dest",
+    "--copy-dest",
+    "--link-dest",
+    "--partial-dir",
+    "--log-file",
+    "--password-file",
+    "--bwlimit",
+    "--timeout",
+    "--contimeout",
+    "--port",
+    "--sockopts",
+    "--address",
+    "--chmod",
+    "--chown",
+    "--max-size",
+    "--min-size",
+    "--modify-window",
+    "--out-format",
+    "--log-file-format",
+    "--backup-dir",
+    "--suffix",
+    "--iconv",
+    "--max-delete",
+    "--checksum-choice",
+    "--info",
+    "--debug",
+    "--stderr",
+    "--outbuf",
+    "--skip-compress",
+    "--usermap",
+    "--groupmap",
+    "--mkpath",
+    "--write-batch",
+    "--read-batch",
+    "--only-write-batch"
+  ]),
   curl: /* @__PURE__ */ new Set([
     "-d",
     "--data",
@@ -2333,23 +2388,163 @@ var VALUE_FLAGS = {
   ]),
   nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
 };
+var HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+var assignmentTable = null;
+var currentStmtOffset = Number.MAX_SAFE_INTEGER;
+var PAYLOAD_BUDGET = 256;
+var payloadBudget = 0;
+var seenPayloads = null;
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+var UNANALYSABLE_NESTING = {
+  ruleName: "review-unanalysable-nesting",
+  verdict: "review",
+  reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+  path: ""
+};
+var ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+var AND_OP = probeBinOp("a && b");
+var OR_OP = probeBinOp("a || b");
+var AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function parseDestHost(token) {
   if (!token) return null;
   let t = token.trim();
@@ -2404,6 +2599,7 @@ function destTokensForBinary(binary, args) {
     case "ssh":
       return positionals.slice(0, 1);
     case "scp":
+    case "rsync":
       return positionals.filter((p) => p.includes(":") || p.includes("@"));
     case "nc":
     case "ncat":
@@ -2604,17 +2800,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2643,9 +2857,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -2654,7 +2889,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -2669,6 +2904,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -2726,6 +2966,18 @@ function resolveCopyShape(words, h) {
   return null;
 }
 var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -2741,8 +2993,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -2946,6 +3203,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -3027,18 +3293,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
@@ -5647,8 +5916,8 @@ function matchCanaryArgs(args, values) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
-var CANONICAL_EXTRACTOR_HASH = "ca0a79b38a804347";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v18";
+var CANONICAL_EXTRACTOR_HASH = "5b2e76537f368d99";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.22.1",
+  "version": "2.23.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",