@node9/proxy 1.67.1 → 1.67.3

package/dist/dashboard.mjs

@@ -184,6 +184,125 @@ function scanArgs(args, depth = 0, fieldPath = "args") {
   }
   return null;
 }
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!safeRegex2(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+function matchesPattern(text, patterns) {
+  const p = Array.isArray(patterns) ? patterns : [patterns];
+  if (p.length === 0) return false;
+  const isMatch = pm(p, { nocase: true, dot: true });
+  const target = text.toLowerCase();
+  const directMatch = isMatch(target);
+  if (directMatch) return true;
+  const withoutDotSlash = text.replace(/^\.\//, "");
+  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
+}
+function getNestedValue(obj, path11) {
+  if (!obj || typeof obj !== "object") return null;
+  const segments = path11.split(".");
+  for (const seg of segments) {
+    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
+  }
+  return segments.reduce((prev, curr) => prev?.[curr], obj);
+}
+function evaluateSmartConditions(args, rule) {
+  if (!rule.conditions || rule.conditions.length === 0) return true;
+  const mode = rule.conditionMode ?? "all";
+  const fieldCache = /* @__PURE__ */ new Map();
+  const resolveField = (field) => {
+    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
+    const rawVal = getNestedValue(args, field);
+    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
+    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
+    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
+    fieldCache.set(field, val);
+    return val;
+  };
+  const readingsCache = /* @__PURE__ */ new Map();
+  const resolveFieldReadings = (field) => {
+    const cached = readingsCache.get(field);
+    if (cached) return cached;
+    const primary = resolveField(field);
+    if (primary === null) {
+      readingsCache.set(field, []);
+      return [];
+    }
+    let out = [primary];
+    if (field === "command") {
+      const raw = getNestedValue(args, field);
+      if (typeof raw === "string") {
+        const collapsed = commandReadings(raw).map((r) => r.replace(/\s+/g, " ").trim());
+        out = [.../* @__PURE__ */ new Set([primary, ...collapsed])];
+      }
+    }
+    readingsCache.set(field, out);
+    return out;
+  };
+  const results = rule.conditions.map((cond) => {
+    const val = resolveField(cond.field);
+    switch (cond.op) {
+      case "exists":
+        return val !== null && val !== "";
+      case "notExists":
+        return val === null || val === "";
+      case "contains":
+        return val !== null && cond.value ? val.includes(cond.value) : false;
+      case "notContains":
+        return val !== null && cond.value ? !val.includes(cond.value) : true;
+      case "matches": {
+        if (val === null || !cond.value) return false;
+        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reM) return false;
+        return resolveFieldReadings(cond.field).some((v) => reM.test(v));
+      }
+      case "notMatches": {
+        if (!cond.value) return false;
+        if (val === null) return true;
+        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reN) return false;
+        return !resolveFieldReadings(cond.field).some((v) => reN.test(v));
+      }
+      case "matchesGlob":
+        return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
+      case "notMatchesGlob":
+        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : false;
+      default:
+        return false;
+    }
+  });
+  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
+}
 function isCatHeredocOrLit(part) {
   if (!part) return false;
   const t = syntax.NodeType(part);
@@ -237,14 +356,22 @@ function cachedNormalize(command, compute) {
   return result;
 }
 function normalizeCommandForPolicy(command) {
+  return commandReadingsImpl(command).posix;
+}
+function commandReadings(command) {
+  const r = commandReadingsImpl(command);
+  return r.separator === r.posix ? [r.posix] : [r.posix, r.separator];
+}
+function commandReadingsImpl(command) {
   return cachedNormalize(command, () => normalizeCommandForPolicyImpl(command));
 }
 function normalizeCommandForPolicyImpl(command) {
   const f = parseShared(command);
-  if (f === PARSE_FAIL) return command;
+  if (f === PARSE_FAIL) return { posix: command, separator: command };
   try {
     const strips = [];
     const rewrites = [];
+    const quoteOnlyRewrites = [];
     const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
@@ -289,22 +416,23 @@ function normalizeCommandForPolicyImpl(command) {
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
+        const quoteOnly = source.replace(/['"]/g, "");
+        if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
       }
       return true;
     });
-    const edits = [
-      ...strips.map(([s, e]) => [s, e, '""']),
-      ...rewrites
-    ];
-    if (edits.length === 0) return command;
-    edits.sort((a, b) => b[0] - a[0]);
-    let result = command;
-    for (const [s, e, rep] of edits) {
-      result = result.slice(0, s) + rep + result.slice(e);
-    }
-    return result;
+    const stripEdits = strips.map(([s, e]) => [s, e, '""']);
+    const apply = (extra) => {
+      const edits = [...stripEdits, ...extra];
+      if (edits.length === 0) return command;
+      edits.sort((a, b) => b[0] - a[0]);
+      let out = command;
+      for (const [s, e, rep] of edits) out = out.slice(0, s) + rep + out.slice(e);
+      return out;
+    };
+    return { posix: apply(rewrites), separator: apply(quoteOnlyRewrites) };
   } catch {
-    return command;
+    return { posix: command, separator: command };
   }
 }
 function scanArgsForDynamicExec(args, startIdx) {
@@ -359,6 +487,20 @@ function detectDangerousShellExec(command) {
     return null;
   }
 }
+function isBashTool(toolName) {
+  return BASH_TOOL_NAMES.has(toolName.toLowerCase());
+}
+function isShellShapedTool(toolName, toolInspection) {
+  if (isBashTool(toolName)) return true;
+  if (!toolInspection) return false;
+  const pattern = Object.keys(toolInspection).find((p) => matchesPattern(toolName, p));
+  return pattern !== void 0 && toolInspection[pattern] === "command";
+}
+function toolMatchesRule(toolName, ruleTool, toolInspection) {
+  if (!ruleTool) return true;
+  if (matchesPattern(toolName, ruleTool)) return true;
+  return isShellShapedTool(toolName, toolInspection) && matchesPattern("bash", ruleTool);
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -517,105 +659,6 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
-function validateRegex(pattern) {
-  if (!pattern) return "Pattern is required";
-  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return `Invalid regex syntax: ${e.message}`;
-  }
-  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
-  if (!safeRegex2(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
-  return null;
-}
-function getCompiledRegex(pattern, flags = "") {
-  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
-  const key = `${pattern}\0${flags}`;
-  if (regexCache.has(key)) {
-    const cached = regexCache.get(key);
-    regexCache.delete(key);
-    regexCache.set(key, cached);
-    return cached;
-  }
-  if (validateRegex(pattern) !== null) return null;
-  try {
-    const re = new RegExp(pattern, flags);
-    if (regexCache.size >= REGEX_CACHE_MAX) {
-      const oldest = regexCache.keys().next().value;
-      if (oldest) regexCache.delete(oldest);
-    }
-    regexCache.set(key, re);
-    return re;
-  } catch {
-    return null;
-  }
-}
-function matchesPattern(text, patterns) {
-  const p = Array.isArray(patterns) ? patterns : [patterns];
-  if (p.length === 0) return false;
-  const isMatch = pm(p, { nocase: true, dot: true });
-  const target = text.toLowerCase();
-  const directMatch = isMatch(target);
-  if (directMatch) return true;
-  const withoutDotSlash = text.replace(/^\.\//, "");
-  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
-}
-function getNestedValue(obj, path11) {
-  if (!obj || typeof obj !== "object") return null;
-  const segments = path11.split(".");
-  for (const seg of segments) {
-    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
-  }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
-}
-function evaluateSmartConditions(args, rule) {
-  if (!rule.conditions || rule.conditions.length === 0) return true;
-  const mode = rule.conditionMode ?? "all";
-  const fieldCache = /* @__PURE__ */ new Map();
-  const resolveField = (field) => {
-    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
-    const rawVal = getNestedValue(args, field);
-    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
-    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
-    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
-    fieldCache.set(field, val);
-    return val;
-  };
-  const results = rule.conditions.map((cond) => {
-    const val = resolveField(cond.field);
-    switch (cond.op) {
-      case "exists":
-        return val !== null && val !== "";
-      case "notExists":
-        return val === null || val === "";
-      case "contains":
-        return val !== null && cond.value ? val.includes(cond.value) : false;
-      case "notContains":
-        return val !== null && cond.value ? !val.includes(cond.value) : true;
-      case "matches": {
-        if (val === null || !cond.value) return false;
-        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reM) return false;
-        return reM.test(val);
-      }
-      case "notMatches": {
-        if (!cond.value) return false;
-        if (val === null) return true;
-        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reN) return false;
-        return !reN.test(val);
-      }
-      case "matchesGlob":
-        return val !== null && cond.value ? pm.isMatch(val, cond.value) : false;
-      case "notMatchesGlob":
-        return val !== null && cond.value ? !pm.isMatch(val, cond.value) : false;
-      default:
-        return false;
-    }
-  });
-  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
-}
 function isShieldVerdict(v) {
   return v === "allow" || v === "review" || v === "block";
 }
@@ -669,7 +712,7 @@ function assertBuiltinShieldRegexesAreSafe() {
     }
   }
 }
-var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
+var ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, FS_OP_CACHE_MAX, fsOpCache, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, COST_PER_LOOP_ITER_USD, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -1159,6 +1202,10 @@ var init_dist = __esm({
     MAX_DEPTH = 5;
     MAX_STRING_BYTES = 1e5;
     MAX_JSON_PARSE_BYTES = 1e4;
+    MAX_REGEX_LENGTH = 256;
+    REGEX_CACHE_MAX = 500;
+    regexCache = /* @__PURE__ */ new Map();
+    FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
     ({ syntax } = mvdanSh);
     sharedParser = syntax.NewParser();
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
@@ -1192,9 +1239,34 @@ var init_dist = __esm({
       "vi",
       "emacs",
       "code",
-      "type"
+      "type",
+      // — the 22 that were missing —
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "awk",
+      "gawk",
+      "sed",
+      "cut",
+      "tr",
+      "jq",
+      "yq",
+      "od",
+      "xxd",
+      "hexdump",
+      "strings",
+      "sort",
+      "uniq",
+      "tac",
+      "nl",
+      "dd"
     ]);
-    FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+    FS_OP_PRESCREEN_RE = new RegExp(
+      `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+    );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
       ".npm/_npx",
@@ -1233,9 +1305,37 @@ var init_dist = __esm({
         // for the canonical test-asserted contract.
         rule: "shield:project-jail:block-read-env",
         reason: "Reading .env files is blocked by project-jail shield",
-        match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-          p
-        )
+        // Structural, not a list. The previous form enumerated seven suffixes and
+        // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+        // gitignored, all routinely holding real secrets — were never covered. A
+        // hand-written list of what to protect is only ever as complete as the day
+        // it was typed; this says "`.env` plus any suffix chain" and then names the
+        // exceptions, which is the direction that fails safe.
+        //
+        //   \.env          the segment itself
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //                  files. Without it a flat suffix class swallows both.
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+        //                  `(\.[\w-]+)*` reads the same but is rejected by
+        //                  safe-regex2, and this pattern runs on the hook hot path.
+        //
+        // The two exclusions are NOT the same shape, because the words do not mean
+        // the same thing:
+        //
+        //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+        //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+        //     These are checked into git by convention: already public, so blocking
+        //     them buys nothing and costs the most common legitimate agent read.
+        //
+        //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+        //     fixture. `.env.test` is the committed template and stays allowed, but
+        //     `.env.test.local` is gitignored by the `.env*.local` convention and
+        //     holds real values, so it must block. Using `\b` here — the obvious
+        //     symmetry — silently exempts every `.env.test.*` file.
+        //
+        // shields.test.ts:983-995 is the canonical contract; keep both in step.
+        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
       },
       {
         // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1269,6 +1369,13 @@ var init_dist = __esm({
         )
       }
     ];
+    BASH_TOOL_NAMES = /* @__PURE__ */ new Set([
+      "bash",
+      "execute_bash",
+      "run_shell_command",
+      "shell",
+      "exec_command"
+    ]);
     AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
       "block-rm-rf-home",
       "shield:project-jail:block-read-ssh",
@@ -1292,10 +1399,6 @@ var init_dist = __esm({
       deriveRedirOp("cat <<X\nX"),
       deriveRedirOp("cat <<-X\nX")
     ]);
-    MAX_REGEX_LENGTH = 100;
-    REGEX_CACHE_MAX = 500;
-    regexCache = /* @__PURE__ */ new Map();
-    FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
     aws_default = {
       name: "aws",
       description: "Protects AWS infrastructure from destructive AI operations",
@@ -2461,6 +2564,7 @@ var init_managed = __esm({
 var init_build = __esm({
   "src/shields/build.ts"() {
     "use strict";
+    init_dist();
   }
 });
 
@@ -2493,8 +2597,14 @@ var init_config = __esm({
       settings: {
         mode: "standard",
         autoStartDaemon: true,
-        enableUndo: true,
-        // 🔥 ALWAYS TRUE BY DEFAULT for the safety net
+        // OFF by default. The snapshot store is a per-project bare git repo with
+        // no size ceiling, and eviction drops the index row without deleting the
+        // objects — on one machine it reached 378G (352G of it orphaned tmp_pack_*
+        // from interrupted `git gc`) and filled the disk. A security tool must not
+        // be what fills a customer's disk. Re-enable per install with
+        // `{"settings":{"enableUndo":true}}`; the default flips back when the
+        // bounded copy-store lands (doc/undo-v2-copy-store-design.md).
+        enableUndo: false,
         enableHookLogDebug: true,
         approvalTimeoutMs: 12e4,
         // 120-second auto-deny timeout
@@ -2693,7 +2803,8 @@ var init_config = __esm({
         skillPinning: { enabled: false, mode: "warn", roots: [] },
         trustedHosts: [],
         trustedHostsManaged: false,
-        appPermissions: {}
+        appPermissions: {},
+        managedJailPaths: []
       },
       environments: {}
     };
@@ -3034,6 +3145,7 @@ var init_scan_watermark = __esm({
   "src/daemon/scan-watermark.ts"() {
     "use strict";
     init_dlp();
+    init_config();
     init_dist();
     MAX_LINE_BYTES = 2 * 1024 * 1024;
   }
@@ -3813,6 +3925,7 @@ var init_policy = __esm({
     init_trusted_hosts();
     init_dist();
     init_dist();
+    init_dist();
   }
 });
 
@@ -4187,7 +4300,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
         }
       }
       let astFsMatched = false;
-      const astRanForBash = toolNameLower === "bash" || toolNameLower === "execute_bash";
+      const astRanForBash = isShellShapedTool(toolNameLower, toolInspectionMap);
       if (astRanForBash) {
         astFsMatched = pushFsOpAstFinding(
           String(input.command ?? ""),
@@ -4205,7 +4318,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       for (const source of ruleSources) {
         const { rule } = source;
         if (rule.verdict === "allow") continue;
-        if (rule.tool && !matchesPattern(toolNameLower, rule.tool)) continue;
+        if (!toolMatchesRule(toolNameLower, rule.tool, toolInspectionMap)) continue;
         if (astRanForBash && rule.name && AST_FS_REGEX_RULES.has(rule.name)) continue;
         if (!evaluateSmartConditions(input, rule)) continue;
         const inputPreview = preview(input, 120);
@@ -4487,7 +4600,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
             }
           }
           let astFsMatched = false;
-          const astRanForBash = toolNameLower === "run_shell_command" || toolNameLower === "shell";
+          const astRanForBash = isShellShapedTool(toolNameLower, toolInspectionMap);
           if (astRanForBash) {
             astFsMatched = pushFsOpAstFinding(
               String(input.command ?? ""),
@@ -4505,7 +4618,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
           for (const source of ruleSources) {
             const { rule } = source;
             if (rule.verdict === "allow") continue;
-            if (rule.tool && !matchesPattern(toolNameLower, rule.tool)) continue;
+            if (!toolMatchesRule(toolNameLower, rule.tool, toolInspectionMap)) continue;
             if (astRanForBash && rule.name && AST_FS_REGEX_RULES.has(rule.name)) continue;
             if (!evaluateSmartConditions(input, rule)) continue;
             const inputPreview = preview(input, 120);
@@ -4727,7 +4840,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         }
       }
       let astFsMatched = false;
-      const astRanForBash = toolNameLower === "exec_command" || toolNameLower === "bash";
+      const astRanForBash = isShellShapedTool(toolNameLower, toolInspectionMap);
       if (astRanForBash) {
         astFsMatched = pushFsOpAstFinding(
           String(input["command"] ?? ""),
@@ -4745,8 +4858,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
       for (const source of ruleSources) {
         const { rule } = source;
         if (rule.verdict === "allow") continue;
-        if (rule.tool && !matchesPattern(toolNameLower === "exec_command" ? "bash" : toolNameLower, rule.tool))
-          continue;
+        if (rule.tool && !toolMatchesRule(toolNameLower, rule.tool, toolInspectionMap)) continue;
         if (astRanForBash && rule.name && AST_FS_REGEX_RULES.has(rule.name)) continue;
         if (!evaluateSmartConditions(input, rule)) continue;
         const inputPreview = preview(input, 120);
@@ -4807,7 +4919,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
   }
   return result;
 }
-var CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, FIXTURE_TOKEN_PATTERNS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
+var toolInspectionMap, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, FIXTURE_TOKEN_PATTERNS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -4828,6 +4940,7 @@ var init_scan = __esm({
     init_protection();
     init_scan_json();
     init_scan_history();
+    toolInspectionMap = DEFAULT_CONFIG.policy.toolInspection;
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
       ".tsx",