@node9/proxy 1.61.0 → 1.62.0

package/dist/dashboard.mjs

@@ -443,6 +443,20 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -655,7 +669,7 @@ function assertBuiltinShieldRegexesAreSafe() {
     }
   }
 }
-var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
+var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -1273,6 +1287,11 @@ var init_dist = __esm({
     ]);
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
+    REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+    REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX")
+    ]);
     MAX_REGEX_LENGTH = 100;
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();

package/dist/index.js

@@ -1351,7 +1351,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1671,6 +1671,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2398,8 +2489,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/dist/index.mjs

@@ -1321,7 +1321,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1641,6 +1641,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2368,8 +2459,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/dist/scan-ink.mjs

@@ -818,6 +818,25 @@ function assertBuiltinPatternsAreSafe() {
 assertBuiltinPatternsAreSafe();
 var { syntax } = mvdanSh;
 var sharedParser = syntax.NewParser();
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",