@node9/policy-engine 2.6.2 → 2.7.1

package/dist/index.d.mts

@@ -202,6 +202,7 @@ declare function normalizeCommandForPolicy(command: string): string;
 declare function detectDangerousShellExec(command: string): 'block' | 'review' | null;
 /** @deprecated Use detectDangerousShellExec — kept for backwards compatibility */
 declare const detectDangerousEval: typeof detectDangerousShellExec;
+declare const FS_READ_TOOLS: Set<string>;
 interface FsOpVerdict {
     ruleName: string;
     verdict: 'block' | 'review';
@@ -1043,8 +1044,6 @@ interface CanonicalFinding {
     occurrenceCount: number;
     /** AST findings: the path that triggered the verdict. */
     subjectPath?: string;
-    /** Loop findings: dollar cost so far. Loop-only today; optional everywhere. */
-    costUsd?: number;
     /** Loop findings: number of iterations. */
     loopCount?: number;
     loopKind?: 'loop' | 'long-iteration';
@@ -1143,7 +1142,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
+declare const CANONICAL_EXTRACTOR_HASH = "0d6c1ddb9a5af5b7";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1170,4 +1169,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -202,6 +202,7 @@ declare function normalizeCommandForPolicy(command: string): string;
 declare function detectDangerousShellExec(command: string): 'block' | 'review' | null;
 /** @deprecated Use detectDangerousShellExec — kept for backwards compatibility */
 declare const detectDangerousEval: typeof detectDangerousShellExec;
+declare const FS_READ_TOOLS: Set<string>;
 interface FsOpVerdict {
     ruleName: string;
     verdict: 'block' | 'review';
@@ -1043,8 +1044,6 @@ interface CanonicalFinding {
     occurrenceCount: number;
     /** AST findings: the path that triggered the verdict. */
     subjectPath?: string;
-    /** Loop findings: dollar cost so far. Loop-only today; optional everywhere. */
-    costUsd?: number;
     /** Loop findings: number of iterations. */
     loopCount?: number;
     loopKind?: 'loop' | 'long-iteration';
@@ -1143,7 +1142,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
+declare const CANONICAL_EXTRACTOR_HASH = "0d6c1ddb9a5af5b7";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1170,4 +1169,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -43,6 +43,7 @@ __export(src_exports, {
   ENGINE_VERSION: () => ENGINE_VERSION,
   FILE_TOOLS: () => FILE_TOOLS,
   FLAGS_WITH_VALUES: () => FLAGS_WITH_VALUES,
+  FS_READ_TOOLS: () => FS_READ_TOOLS,
   LONG_OUTPUT_THRESHOLD_BYTES: () => LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS: () => LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE: () => LOOP_THRESHOLD_FOR_WASTE,
@@ -3979,7 +3980,7 @@ function detectArgsPii(args) {
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
-var CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
+var CANONICAL_EXTRACTOR_HASH = "0d6c1ddb9a5af5b7";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -4222,8 +4223,7 @@ function extractSessionLevelFindings(calls, ctx) {
       occurrenceCount: 1,
       loopCount: verdict.count,
       loopKind: "loop",
-      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN),
-      costUsd: verdict.count * COST_PER_LOOP_ITER_USD
+      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN)
     });
   }
   return out;
@@ -4245,9 +4245,6 @@ function dedupeCanonicalFindings(findings) {
     if (f.lastSeenAt && f.lastSeenAt > prev.lastSeenAt) {
       prev.lastSeenAt = f.lastSeenAt;
     }
-    if (f.costUsd !== void 0) {
-      prev.costUsd = (prev.costUsd ?? 0) + f.costUsd;
-    }
     if (f.loopCount !== void 0) {
       prev.loopCount = (prev.loopCount ?? 0) + f.loopCount;
     }
@@ -4341,6 +4338,7 @@ var ENGINE_VERSION = "1.4.0";
   ENGINE_VERSION,
   FILE_TOOLS,
   FLAGS_WITH_VALUES,
+  FS_READ_TOOLS,
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,

package/dist/index.mjs

@@ -3865,7 +3865,7 @@ function detectArgsPii(args) {
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
 var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
-var CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
+var CANONICAL_EXTRACTOR_HASH = "0d6c1ddb9a5af5b7";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -4108,8 +4108,7 @@ function extractSessionLevelFindings(calls, ctx) {
       occurrenceCount: 1,
       loopCount: verdict.count,
       loopKind: "loop",
-      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN),
-      costUsd: verdict.count * COST_PER_LOOP_ITER_USD
+      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN)
     });
   }
   return out;
@@ -4131,9 +4130,6 @@ function dedupeCanonicalFindings(findings) {
     if (f.lastSeenAt && f.lastSeenAt > prev.lastSeenAt) {
       prev.lastSeenAt = f.lastSeenAt;
     }
-    if (f.costUsd !== void 0) {
-      prev.costUsd = (prev.costUsd ?? 0) + f.costUsd;
-    }
     if (f.loopCount !== void 0) {
       prev.loopCount = (prev.loopCount ?? 0) + f.loopCount;
     }
@@ -4226,6 +4222,7 @@ export {
   ENGINE_VERSION,
   FILE_TOOLS,
   FLAGS_WITH_VALUES,
+  FS_READ_TOOLS,
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.6.2",
+  "version": "2.7.1",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",