@node9/proxy 1.60.0 → 1.61.1

package/dist/cli.js

@@ -973,6 +973,91 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok2 = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok2) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok2 = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok2 = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok2 = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok2;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -1543,8 +1628,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -2285,7 +2371,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -2962,7 +3048,7 @@ var init_dist = __esm({
       "mongosh"
     ]);
     SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
-    CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+    CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
     COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
       "sudo",
       "doas",
@@ -3065,6 +3151,12 @@ var init_dist = __esm({
     };
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
+    stripDotSlash = (p) => p.replace(/^\.\//, "");
+    REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+    REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX")
+    ]);
     DEFAULT_EGRESS_ALLOWLIST = [
       "*.github.com",
       "*.githubusercontent.com",
@@ -49212,9 +49304,10 @@ function loadGeminiCost(start, end, geminiTmpDir2) {
 function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "mcp";
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+    return "detection";
+  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
-  if (checkedBy === "loop-detected") return "toolRules";
   if (checkedBy === "timeout" || checkedBy === "local-decision") return "approvals";
   return "toolRules";
 }
@@ -49317,7 +49410,9 @@ function aggregateReportFromAudit(period, opts = {}) {
   let dimDataObserved = 0;
   let dimFilesBlocked = 0;
   let dimToolRulesBlocked = 0;
-  let dimMcpBlocked = 0;
+  let dimAppsBlocked = 0;
+  let dimPinMismatch = 0;
+  let dimInjectionBlocked = 0;
   for (const e of entries) {
     if (superseded.has(supersedeKey(e))) continue;
     const allow = isAllow(e.decision);
@@ -49335,6 +49430,8 @@ function aggregateReportFromAudit(period, opts = {}) {
     }
     if (e.checkedBy === "loop-detected") loopHits++;
     const cb = e.checkedBy ?? "";
+    if (cb === "mcp-pin-mismatch") dimPinMismatch++;
+    if (cb.startsWith("injection")) dimInjectionBlocked++;
     if (cb.includes("would-block") && (cb.includes("pii") || cb.includes("dlp"))) {
       dimDataObserved++;
     }
@@ -49346,8 +49443,8 @@ function aggregateReportFromAudit(period, opts = {}) {
         case "files":
           dimFilesBlocked++;
           break;
-        case "mcp":
-          dimMcpBlocked++;
+        case "apps":
+          dimAppsBlocked++;
           break;
         case "toolRules":
           dimToolRulesBlocked++;
@@ -49427,9 +49524,15 @@ function aggregateReportFromAudit(period, opts = {}) {
     dimensions: {
       network: { blocked: dimNetworkBlocked },
       data: { blocked: dlpBlocked, observed: dimDataObserved },
+      detection: {
+        loops: loopHits,
+        pinMismatches: dimPinMismatch,
+        injections: dimInjectionBlocked
+      },
       approvals: { approved: userApproved, denied: userDenied, timedOut },
       files: { blocked: dimFilesBlocked },
-      toolRules: { blocked: dimToolRulesBlocked, mcp: dimMcpBlocked, loops: loopHits },
+      toolRules: { blocked: dimToolRulesBlocked },
+      apps: { blocked: dimAppsBlocked },
       cost: { totalUSD: claudeCost.total + codexCost.total + geminiCost.total }
     },
     generatedAt: now.toISOString()
@@ -49729,6 +49832,12 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       d.data.blocked + d.data.observed > 0,
       `${num2(d.data.blocked)} blocked \xB7 ${num2(d.data.observed)} observed (DLP/PII)`
     );
+    dimRow(
+      "\u{1F501}",
+      "Detection",
+      d.detection.loops + d.detection.pinMismatches + d.detection.injections > 0,
+      `${num2(d.detection.loops)} loops \xB7 ${num2(d.detection.pinMismatches)} pin \xB7 ${num2(d.detection.injections)} injection`
+    );
     dimRow(
       "\u270B",
       "Approvals",
@@ -49739,9 +49848,10 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
     dimRow(
       "\u{1F6E0}",
       "Tool rules",
-      d.toolRules.blocked + d.toolRules.mcp + d.toolRules.loops > 0,
-      `${num2(d.toolRules.blocked)} shields/rules \xB7 ${num2(d.toolRules.mcp)} MCP \xB7 ${num2(d.toolRules.loops)} loops`
+      d.toolRules.blocked > 0,
+      `${num2(d.toolRules.blocked)} shields/rules`
     );
+    dimRow("\u{1F9E9}", "Apps (MCP)", d.apps.blocked > 0, `${num2(d.apps.blocked)} app-permission blocks`);
     dimRow("\u{1F4B0}", "Cost", d.cost.totalUSD > 0, `${fmtCost2(d.cost.totalUSD)} this period`);
   }
   console.log("");
@@ -50817,7 +50927,7 @@ function normalizeClientName(name) {
   const sanitized = sanitize4(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
-function reportPinMismatchToCloud(serverKey, agent) {
+function reportPinMismatchToCloud(serverKey, serverLabel, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50826,18 +50936,18 @@ function reportPinMismatchToCloud(serverKey, agent) {
       { serverKey, reason: "tool-pin-mismatch" },
       "mcp-pin-mismatch",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       {
         ruleName: "MCP tool definitions changed (possible rug pull)",
-        ruleDescription: `The MCP server "${serverKey}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
+        ruleDescription: `The MCP server "${serverLabel}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
       }
     );
   } catch {
   }
 }
-function reportInventoryToCloud(serverKey, toolCount, agent) {
+function reportInventoryToCloud(serverKey, serverLabel, toolCount, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50846,7 +50956,7 @@ function reportInventoryToCloud(serverKey, toolCount, agent) {
       { serverKey, toolCount },
       "mcp-discovered",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       { mcpToolCount: toolCount }
@@ -50854,7 +50964,7 @@ function reportInventoryToCloud(serverKey, toolCount, agent) {
   } catch {
   }
 }
-function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
+function reportLargeResponseToCloud(serverKey, serverLabel, responseBytes, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50863,7 +50973,7 @@ function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
       { serverKey, responseBytes },
       "mcp-large-response",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       { mcpResponseBytes: responseBytes }
@@ -51100,7 +51210,12 @@ async function runMcpGateway(upstreamCommand, configName) {
         const currentHash = hashToolDefinitions(tools);
         const pinStatus = checkPin(serverKey, currentHash, gatewayCwd);
         const token = getInternalToken();
-        reportInventoryToCloud(serverKey, tools.length, clientName);
+        reportInventoryToCloud(
+          serverKey,
+          resolveServerLabel("", serverKey, upstreamCommand, configName),
+          tools.length,
+          clientName
+        );
         if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
           const toolSummary = tools.map((t) => ({ name: t.name, description: t.description }));
           fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/discovered`, {
@@ -51172,7 +51287,11 @@ async function runMcpGateway(upstreamCommand, configName) {
           console.error(import_chalk21.default.red("   Session quarantined \u2014 all tool calls blocked."));
           console.error(import_chalk21.default.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
-          reportPinMismatchToCloud(serverKey, clientName);
+          reportPinMismatchToCloud(
+            serverKey,
+            resolveServerLabel("", serverKey, upstreamCommand, configName),
+            clientName
+          );
           const errorResponse = {
             jsonrpc: "2.0",
             id: parsed.id,
@@ -51218,7 +51337,12 @@ async function runMcpGateway(upstreamCommand, configName) {
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
-      reportLargeResponseToCloud(serverKey, line.length, clientName);
+      reportLargeResponseToCloud(
+        serverKey,
+        resolveServerLabel("", serverKey, upstreamCommand, configName),
+        line.length,
+        clientName
+      );
       if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
         const token = getInternalToken();
         fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/large-response`, {

package/dist/cli.mjs

@@ -983,6 +983,91 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok2 = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok2) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok2 = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok2 = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok2 = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok2;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -1553,8 +1638,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -2295,7 +2381,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -2966,7 +3052,7 @@ var init_dist = __esm({
       "mongosh"
     ]);
     SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
-    CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+    CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
     COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
       "sudo",
       "doas",
@@ -3069,6 +3155,12 @@ var init_dist = __esm({
     };
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
+    stripDotSlash = (p) => p.replace(/^\.\//, "");
+    REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+    REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX")
+    ]);
     DEFAULT_EGRESS_ALLOWLIST = [
       "*.github.com",
       "*.githubusercontent.com",
@@ -49205,9 +49297,10 @@ function loadGeminiCost(start, end, geminiTmpDir2) {
 function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "mcp";
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+    return "detection";
+  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
-  if (checkedBy === "loop-detected") return "toolRules";
   if (checkedBy === "timeout" || checkedBy === "local-decision") return "approvals";
   return "toolRules";
 }
@@ -49310,7 +49403,9 @@ function aggregateReportFromAudit(period, opts = {}) {
   let dimDataObserved = 0;
   let dimFilesBlocked = 0;
   let dimToolRulesBlocked = 0;
-  let dimMcpBlocked = 0;
+  let dimAppsBlocked = 0;
+  let dimPinMismatch = 0;
+  let dimInjectionBlocked = 0;
   for (const e of entries) {
     if (superseded.has(supersedeKey(e))) continue;
     const allow = isAllow(e.decision);
@@ -49328,6 +49423,8 @@ function aggregateReportFromAudit(period, opts = {}) {
     }
     if (e.checkedBy === "loop-detected") loopHits++;
     const cb = e.checkedBy ?? "";
+    if (cb === "mcp-pin-mismatch") dimPinMismatch++;
+    if (cb.startsWith("injection")) dimInjectionBlocked++;
     if (cb.includes("would-block") && (cb.includes("pii") || cb.includes("dlp"))) {
       dimDataObserved++;
     }
@@ -49339,8 +49436,8 @@ function aggregateReportFromAudit(period, opts = {}) {
         case "files":
           dimFilesBlocked++;
           break;
-        case "mcp":
-          dimMcpBlocked++;
+        case "apps":
+          dimAppsBlocked++;
           break;
         case "toolRules":
           dimToolRulesBlocked++;
@@ -49420,9 +49517,15 @@ function aggregateReportFromAudit(period, opts = {}) {
     dimensions: {
       network: { blocked: dimNetworkBlocked },
       data: { blocked: dlpBlocked, observed: dimDataObserved },
+      detection: {
+        loops: loopHits,
+        pinMismatches: dimPinMismatch,
+        injections: dimInjectionBlocked
+      },
       approvals: { approved: userApproved, denied: userDenied, timedOut },
       files: { blocked: dimFilesBlocked },
-      toolRules: { blocked: dimToolRulesBlocked, mcp: dimMcpBlocked, loops: loopHits },
+      toolRules: { blocked: dimToolRulesBlocked },
+      apps: { blocked: dimAppsBlocked },
       cost: { totalUSD: claudeCost.total + codexCost.total + geminiCost.total }
     },
     generatedAt: now.toISOString()
@@ -49722,6 +49825,12 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
       d.data.blocked + d.data.observed > 0,
       `${num2(d.data.blocked)} blocked \xB7 ${num2(d.data.observed)} observed (DLP/PII)`
     );
+    dimRow(
+      "\u{1F501}",
+      "Detection",
+      d.detection.loops + d.detection.pinMismatches + d.detection.injections > 0,
+      `${num2(d.detection.loops)} loops \xB7 ${num2(d.detection.pinMismatches)} pin \xB7 ${num2(d.detection.injections)} injection`
+    );
     dimRow(
       "\u270B",
       "Approvals",
@@ -49732,9 +49841,10 @@ function renderTerminalReport(data, responseDlpEntries, excludeTests) {
     dimRow(
       "\u{1F6E0}",
       "Tool rules",
-      d.toolRules.blocked + d.toolRules.mcp + d.toolRules.loops > 0,
-      `${num2(d.toolRules.blocked)} shields/rules \xB7 ${num2(d.toolRules.mcp)} MCP \xB7 ${num2(d.toolRules.loops)} loops`
+      d.toolRules.blocked > 0,
+      `${num2(d.toolRules.blocked)} shields/rules`
     );
+    dimRow("\u{1F9E9}", "Apps (MCP)", d.apps.blocked > 0, `${num2(d.apps.blocked)} app-permission blocks`);
     dimRow("\u{1F4B0}", "Cost", d.cost.totalUSD > 0, `${fmtCost2(d.cost.totalUSD)} this period`);
   }
   console.log("");
@@ -50810,7 +50920,7 @@ function normalizeClientName(name) {
   const sanitized = sanitize4(name).slice(0, 40);
   return sanitized.length > 0 ? sanitized : void 0;
 }
-function reportPinMismatchToCloud(serverKey, agent) {
+function reportPinMismatchToCloud(serverKey, serverLabel, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50819,18 +50929,18 @@ function reportPinMismatchToCloud(serverKey, agent) {
       { serverKey, reason: "tool-pin-mismatch" },
       "mcp-pin-mismatch",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       {
         ruleName: "MCP tool definitions changed (possible rug pull)",
-        ruleDescription: `The MCP server "${serverKey}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
+        ruleDescription: `The MCP server "${serverLabel}" changed its tool definitions since they were pinned. This can indicate a supply-chain attack (tool poisoning). The session was quarantined. Review with: node9 mcp pin update ${serverKey}`
       }
     );
   } catch {
   }
 }
-function reportInventoryToCloud(serverKey, toolCount, agent) {
+function reportInventoryToCloud(serverKey, serverLabel, toolCount, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50839,7 +50949,7 @@ function reportInventoryToCloud(serverKey, toolCount, agent) {
       { serverKey, toolCount },
       "mcp-discovered",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       { mcpToolCount: toolCount }
@@ -50847,7 +50957,7 @@ function reportInventoryToCloud(serverKey, toolCount, agent) {
   } catch {
   }
 }
-function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
+function reportLargeResponseToCloud(serverKey, serverLabel, responseBytes, agent) {
   try {
     const creds = getCredentials();
     if (!creds) return;
@@ -50856,7 +50966,7 @@ function reportLargeResponseToCloud(serverKey, responseBytes, agent) {
       { serverKey, responseBytes },
       "mcp-large-response",
       creds,
-      { mcpServer: serverKey, agent },
+      { mcpServer: serverLabel, agent },
       void 0,
       false,
       { mcpResponseBytes: responseBytes }
@@ -51093,7 +51203,12 @@ async function runMcpGateway(upstreamCommand, configName) {
         const currentHash = hashToolDefinitions(tools);
         const pinStatus = checkPin(serverKey, currentHash, gatewayCwd);
         const token = getInternalToken();
-        reportInventoryToCloud(serverKey, tools.length, clientName);
+        reportInventoryToCloud(
+          serverKey,
+          resolveServerLabel("", serverKey, upstreamCommand, configName),
+          tools.length,
+          clientName
+        );
         if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
           const toolSummary = tools.map((t) => ({ name: t.name, description: t.description }));
           fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/discovered`, {
@@ -51165,7 +51280,11 @@ async function runMcpGateway(upstreamCommand, configName) {
           console.error(chalk21.red("   Session quarantined \u2014 all tool calls blocked."));
           console.error(chalk21.yellow(`   Run: node9 mcp pin update ${serverKey}
 `));
-          reportPinMismatchToCloud(serverKey, clientName);
+          reportPinMismatchToCloud(
+            serverKey,
+            resolveServerLabel("", serverKey, upstreamCommand, configName),
+            clientName
+          );
           const errorResponse = {
             jsonrpc: "2.0",
             id: parsed.id,
@@ -51211,7 +51330,12 @@ async function runMcpGateway(upstreamCommand, configName) {
           `\u26A1 Node9: Large MCP response from '${toolName}' (${(line.length / 1024).toFixed(0)}KB) \u2014 context window enlarged`
         )
       );
-      reportLargeResponseToCloud(serverKey, line.length, clientName);
+      reportLargeResponseToCloud(
+        serverKey,
+        resolveServerLabel("", serverKey, upstreamCommand, configName),
+        line.length,
+        clientName
+      );
       if (isDaemonRunning() && process.env.NODE9_TESTING !== "1") {
         const token = getInternalToken();
         fetch(`http://${DAEMON_HOST}:${DAEMON_PORT}/mcp/large-response`, {

package/dist/dashboard.mjs

@@ -443,6 +443,20 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -655,7 +669,7 @@ function assertBuiltinShieldRegexesAreSafe() {
     }
   }
 }
-var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
+var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -1273,6 +1287,11 @@ var init_dist = __esm({
     ]);
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
+    REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+    REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX")
+    ]);
     MAX_REGEX_LENGTH = 100;
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
@@ -3438,9 +3457,10 @@ async function loadGeminiCostAsync(start, end, geminiTmpDir) {
 function dimensionOfBlock(checkedBy, ruleName) {
   if (checkedBy.includes("egress")) return "network";
   if (checkedBy.includes("pii") || checkedBy.includes("dlp")) return "data";
-  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "mcp";
+  if (checkedBy === "loop-detected" || checkedBy === "mcp-pin-mismatch" || checkedBy.startsWith("injection"))
+    return "detection";
+  if (checkedBy === "app-permission-block" || ruleName.startsWith("app-permission:")) return "apps";
   if (ruleName.startsWith("shield:project-jail")) return "files";
-  if (checkedBy === "loop-detected") return "toolRules";
   if (checkedBy === "timeout" || checkedBy === "local-decision") return "approvals";
   return "toolRules";
 }
@@ -3543,7 +3563,9 @@ function aggregateReportFromAudit(period, opts = {}) {
   let dimDataObserved = 0;
   let dimFilesBlocked = 0;
   let dimToolRulesBlocked = 0;
-  let dimMcpBlocked = 0;
+  let dimAppsBlocked = 0;
+  let dimPinMismatch = 0;
+  let dimInjectionBlocked = 0;
   for (const e of entries) {
     if (superseded.has(supersedeKey(e))) continue;
     const allow = isAllow(e.decision);
@@ -3561,6 +3583,8 @@ function aggregateReportFromAudit(period, opts = {}) {
     }
     if (e.checkedBy === "loop-detected") loopHits++;
     const cb = e.checkedBy ?? "";
+    if (cb === "mcp-pin-mismatch") dimPinMismatch++;
+    if (cb.startsWith("injection")) dimInjectionBlocked++;
     if (cb.includes("would-block") && (cb.includes("pii") || cb.includes("dlp"))) {
       dimDataObserved++;
     }
@@ -3572,8 +3596,8 @@ function aggregateReportFromAudit(period, opts = {}) {
         case "files":
           dimFilesBlocked++;
           break;
-        case "mcp":
-          dimMcpBlocked++;
+        case "apps":
+          dimAppsBlocked++;
           break;
         case "toolRules":
           dimToolRulesBlocked++;
@@ -3653,9 +3677,15 @@ function aggregateReportFromAudit(period, opts = {}) {
     dimensions: {
       network: { blocked: dimNetworkBlocked },
       data: { blocked: dlpBlocked, observed: dimDataObserved },
+      detection: {
+        loops: loopHits,
+        pinMismatches: dimPinMismatch,
+        injections: dimInjectionBlocked
+      },
       approvals: { approved: userApproved, denied: userDenied, timedOut },
       files: { blocked: dimFilesBlocked },
-      toolRules: { blocked: dimToolRulesBlocked, mcp: dimMcpBlocked, loops: loopHits },
+      toolRules: { blocked: dimToolRulesBlocked },
+      apps: { blocked: dimAppsBlocked },
       cost: { totalUSD: claudeCost.total + codexCost.total + geminiCost.total }
     },
     generatedAt: now.toISOString()

package/dist/index.js

@@ -1351,7 +1351,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1671,6 +1671,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2398,8 +2489,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/dist/index.mjs

@@ -1321,7 +1321,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1641,6 +1641,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2368,8 +2459,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/dist/scan-ink.mjs

@@ -818,6 +818,25 @@ function assertBuiltinPatternsAreSafe() {
 assertBuiltinPatternsAreSafe();
 var { syntax } = mvdanSh;
 var sharedParser = syntax.NewParser();
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.60.0",
+  "version": "1.61.1",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",