@node9/proxy 1.11.0 → 1.11.2

package/dist/index.js

@@ -503,9 +503,8 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            // Require the recursive flag to be preceded by whitespace so that
-            // filenames containing "-r" (e.g. "ai-review.yml") don't false-positive.
-            value: "rm\\b.*\\s(-[rRfF]*[rR][rRfF]*|--recursive)(\\s|$)"
+            // Anchor rm as a shell command (not inside a string arg like a git commit message).
+            value: "(^|&&|\\|\\||;)\\s*rm\\b[^;&|]*\\s(-[rRfF]*[rR][rRfF]*|--recursive)(\\s|$)"
           },
           {
             field: "command",
@@ -534,6 +533,13 @@ var DEFAULT_CONFIG = {
         name: "review-drop-truncate-shell",
         tool: "bash",
         conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Require a DB CLI in the command so grep/cat/echo of SQL strings don't trigger.
+            value: "(^|&&|\\|\\||;|\\|)\\s*(psql|mysql|sqlite3|sqlplus|cockroach|clickhouse-client|mongo)\\b",
+            flags: "i"
+          },
           {
             field: "command",
             op: "matches",
@@ -554,7 +560,9 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            value: "\\bgit\\b.*\\bpush\\b.*(--force|--force-with-lease|-f\\b)",
+            // Anchor git as a shell command so node -e / python -c scripts containing
+            // "git push --force" as a string don't false-positive.
+            value: "(^|&&|\\|\\||;)\\s*git\\s+push[^;&|]*(--force|--force-with-lease|-f\\b)",
             flags: "i"
           }
         ],
@@ -564,29 +572,20 @@ var DEFAULT_CONFIG = {
         description: "The AI wants to force push to a remote git branch. This rewrites shared history and can permanently destroy commits that teammates have already pulled."
       },
       {
-        name: "review-git-push",
+        name: "review-git-destructive",
         tool: "bash",
         conditions: [
           {
             field: "command",
             op: "matches",
-            value: "\\bgit\\b.*\\bpush\\b(?!.*(-f\\b|--force|--force-with-lease))",
+            value: "\\bgit\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase\\b|tag\\s+-d|branch\\s+-[dD])",
             flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "git push sends changes to a shared remote",
-        description: "The AI wants to push commits to a remote repository. Once pushed, those changes are visible to everyone with access."
-      },
-      {
-        name: "review-git-destructive",
-        tool: "bash",
-        conditions: [
+          },
           {
             field: "command",
-            op: "matches",
-            value: "\\bgit\\b.*(reset\\s+--hard|clean\\s+-[fdxX]|\\brebase\\b|tag\\s+-d|branch\\s+-[dD])",
+            op: "notMatches",
+            // Exclude recovery ops — these resolve a conflict, not start a destructive action.
+            value: "\\bgit\\s+rebase\\s+--(abort|continue|skip)\\b",
             flags: "i"
           }
         ],
@@ -612,7 +611,9 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            value: "(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+            // Anchor curl/wget as a shell command so node -e scripts testing this
+            // regex pattern don't self-match as a false positive.
+            value: "(^|&&|\\|\\||;)\\s*(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
             flags: "i"
           }
         ],
@@ -1013,7 +1014,7 @@ var DLP_PATTERNS = [
     regex: /_authToken\s*=\s*[A-Za-z0-9_\-]{20,}/,
     severity: "block"
   },
-  { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/i, severity: "review" }
+  { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i, severity: "review" }
 ];
 var SENSITIVE_PATH_PATTERNS = [
   /[/\\]\.ssh[/\\]/i,
@@ -1603,12 +1604,25 @@ function getNestedValue(obj, path15) {
   if (!obj || typeof obj !== "object") return null;
   return path15.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
+function stripStringArguments(cmd) {
+  let result = cmd;
+  result = result.replace(
+    /\b(node|python3?|ruby|perl|php|deno)\s+(-[ecr]|eval)\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/gi,
+    '$1 $2 ""'
+  );
+  result = result.replace(
+    /\s(-m|--message|--body|--title|--description)\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/g,
+    ' $1 ""'
+  );
+  return result;
+}
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
   const mode = rule.conditionMode ?? "all";
   const results = rule.conditions.map((cond) => {
     const rawVal = getNestedValue(args, cond.field);
-    const val = rawVal !== null && rawVal !== void 0 ? String(rawVal).replace(/\s+/g, " ").trim() : null;
+    const normalized = rawVal !== null && rawVal !== void 0 ? String(rawVal).replace(/\s+/g, " ").trim() : null;
+    const val = cond.field === "command" && normalized !== null ? stripStringArguments(normalized) : normalized;
     switch (cond.op) {
       case "exists":
         return val !== null && val !== "";
@@ -2413,7 +2427,8 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
+  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
   lines.push("");
@@ -2790,7 +2805,16 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = (0, import_crypto3.randomUUID)();
     const actTs = Date.now();
-    await notifyActivity({ id: actId, ts: actTs, tool: toolName, args, status: "pending" });
+    await notifyActivity({
+      id: actId,
+      ts: actTs,
+      tool: toolName,
+      args,
+      status: "pending",
+      // Strip ANSI escape sequences — agent name comes from caller-supplied metadata
+      // and may be displayed in a terminal (node9 tail/watch), enabling injection.
+      agent: meta?.agent ? meta.agent.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80) : void 0
+    });
     const result = await _authorizeHeadlessCore(toolName, args, meta, {
       ...options,
       activityId: actId

package/dist/index.mjs

@@ -473,9 +473,8 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            // Require the recursive flag to be preceded by whitespace so that
-            // filenames containing "-r" (e.g. "ai-review.yml") don't false-positive.
-            value: "rm\\b.*\\s(-[rRfF]*[rR][rRfF]*|--recursive)(\\s|$)"
+            // Anchor rm as a shell command (not inside a string arg like a git commit message).
+            value: "(^|&&|\\|\\||;)\\s*rm\\b[^;&|]*\\s(-[rRfF]*[rR][rRfF]*|--recursive)(\\s|$)"
           },
           {
             field: "command",
@@ -504,6 +503,13 @@ var DEFAULT_CONFIG = {
         name: "review-drop-truncate-shell",
         tool: "bash",
         conditions: [
+          {
+            field: "command",
+            op: "matches",
+            // Require a DB CLI in the command so grep/cat/echo of SQL strings don't trigger.
+            value: "(^|&&|\\|\\||;|\\|)\\s*(psql|mysql|sqlite3|sqlplus|cockroach|clickhouse-client|mongo)\\b",
+            flags: "i"
+          },
           {
             field: "command",
             op: "matches",
@@ -524,7 +530,9 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            value: "\\bgit\\b.*\\bpush\\b.*(--force|--force-with-lease|-f\\b)",
+            // Anchor git as a shell command so node -e / python -c scripts containing
+            // "git push --force" as a string don't false-positive.
+            value: "(^|&&|\\|\\||;)\\s*git\\s+push[^;&|]*(--force|--force-with-lease|-f\\b)",
             flags: "i"
           }
         ],
@@ -534,29 +542,20 @@ var DEFAULT_CONFIG = {
         description: "The AI wants to force push to a remote git branch. This rewrites shared history and can permanently destroy commits that teammates have already pulled."
       },
       {
-        name: "review-git-push",
+        name: "review-git-destructive",
         tool: "bash",
         conditions: [
           {
             field: "command",
             op: "matches",
-            value: "\\bgit\\b.*\\bpush\\b(?!.*(-f\\b|--force|--force-with-lease))",
+            value: "\\bgit\\s+(reset\\s+--hard|clean\\s+-[fdxX]|rebase\\b|tag\\s+-d|branch\\s+-[dD])",
             flags: "i"
-          }
-        ],
-        conditionMode: "all",
-        verdict: "review",
-        reason: "git push sends changes to a shared remote",
-        description: "The AI wants to push commits to a remote repository. Once pushed, those changes are visible to everyone with access."
-      },
-      {
-        name: "review-git-destructive",
-        tool: "bash",
-        conditions: [
+          },
           {
             field: "command",
-            op: "matches",
-            value: "\\bgit\\b.*(reset\\s+--hard|clean\\s+-[fdxX]|\\brebase\\b|tag\\s+-d|branch\\s+-[dD])",
+            op: "notMatches",
+            // Exclude recovery ops — these resolve a conflict, not start a destructive action.
+            value: "\\bgit\\s+rebase\\s+--(abort|continue|skip)\\b",
             flags: "i"
           }
         ],
@@ -582,7 +581,9 @@ var DEFAULT_CONFIG = {
           {
             field: "command",
             op: "matches",
-            value: "(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+            // Anchor curl/wget as a shell command so node -e scripts testing this
+            // regex pattern don't self-match as a false positive.
+            value: "(^|&&|\\|\\||;)\\s*(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
             flags: "i"
           }
         ],
@@ -983,7 +984,7 @@ var DLP_PATTERNS = [
     regex: /_authToken\s*=\s*[A-Za-z0-9_\-]{20,}/,
     severity: "block"
   },
-  { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/i, severity: "review" }
+  { name: "Bearer Token", regex: /Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=*/i, severity: "review" }
 ];
 var SENSITIVE_PATH_PATTERNS = [
   /[/\\]\.ssh[/\\]/i,
@@ -1573,12 +1574,25 @@ function getNestedValue(obj, path15) {
   if (!obj || typeof obj !== "object") return null;
   return path15.split(".").reduce((prev, curr) => prev?.[curr], obj);
 }
+function stripStringArguments(cmd) {
+  let result = cmd;
+  result = result.replace(
+    /\b(node|python3?|ruby|perl|php|deno)\s+(-[ecr]|eval)\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/gi,
+    '$1 $2 ""'
+  );
+  result = result.replace(
+    /\s(-m|--message|--body|--title|--description)\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/g,
+    ' $1 ""'
+  );
+  return result;
+}
 function evaluateSmartConditions(args, rule) {
   if (!rule.conditions || rule.conditions.length === 0) return true;
   const mode = rule.conditionMode ?? "all";
   const results = rule.conditions.map((cond) => {
     const rawVal = getNestedValue(args, cond.field);
-    const val = rawVal !== null && rawVal !== void 0 ? String(rawVal).replace(/\s+/g, " ").trim() : null;
+    const normalized = rawVal !== null && rawVal !== void 0 ? String(rawVal).replace(/\s+/g, " ").trim() : null;
+    const val = cond.field === "command" && normalized !== null ? stripStringArguments(normalized) : normalized;
     switch (cond.op) {
       case "exists":
         return val !== null && val !== "";
@@ -2383,7 +2397,8 @@ function escapePango(text) {
 function buildPlainMessage(toolName, formattedArgs, agent, explainableLabel, locked, allowCount = 1, ruleDescription) {
   const lines = [];
   if (locked) lines.push("\u26A0\uFE0F  LOCKED BY ADMIN POLICY\n");
-  lines.push(`\u{1F916} ${agent || "AI Agent"}  |  \u{1F527} ${toolName}`);
+  const safeAgent = (agent ?? "AI Agent").replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80);
+  lines.push(`\u{1F916} ${safeAgent}  |  \u{1F527} ${toolName}`);
   lines.push(`\u{1F6E1}\uFE0F  ${explainableLabel || "Security Policy"}`);
   if (ruleDescription) lines.push(`\u2139  ${ruleDescription}`);
   lines.push("");
@@ -2760,7 +2775,16 @@ async function authorizeHeadless(toolName, args, meta, options) {
   if (!options?.calledFromDaemon) {
     const actId = randomUUID();
     const actTs = Date.now();
-    await notifyActivity({ id: actId, ts: actTs, tool: toolName, args, status: "pending" });
+    await notifyActivity({
+      id: actId,
+      ts: actTs,
+      tool: toolName,
+      args,
+      status: "pending",
+      // Strip ANSI escape sequences — agent name comes from caller-supplied metadata
+      // and may be displayed in a terminal (node9 tail/watch), enabling injection.
+      agent: meta?.agent ? meta.agent.replace(/\x1b(?:\[[0-9;?]*[a-zA-Z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-_])/g, "").slice(0, 80) : void 0
+    });
     const result = await _authorizeHeadlessCore(toolName, args, meta, {
       ...options,
       activityId: actId

package/dist/shields/builtin/bash-safe.json

@@ -10,7 +10,7 @@
         {
           "field": "command",
           "op": "matches",
-          "value": "(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          "value": "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
           "flags": "i"
         }
       ],
@@ -24,7 +24,7 @@
         {
           "field": "command",
           "op": "matches",
-          "value": "base64\\s+(-d|--decode).*\\|\\s*(bash|sh|zsh)",
+          "value": "\\bbase64\\s+(-d|--decode)[^|;&]*\\|\\s*(bash|sh|zsh)",
           "flags": "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code & MCP.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",