@node9/proxy 1.67.2 → 1.67.4

package/dist/cli.js

@@ -2633,7 +2633,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3165,6 +3165,13 @@ var init_dist = __esm({
     MAX_DEPTH = 5;
     MAX_STRING_BYTES = 1e5;
     MAX_JSON_PARSE_BYTES = 1e4;
+    DLP_SCAN_LIMITS = {
+      /** Max characters examined per individual string field; the remainder of an
+       *  oversized string is NOT scanned. */
+      maxStringBytes: MAX_STRING_BYTES,
+      /** Max nesting depth walked; anything deeper is NOT scanned. */
+      maxDepth: MAX_DEPTH
+    };
     MAX_REGEX_LENGTH = 256;
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
@@ -3202,9 +3209,34 @@ var init_dist = __esm({
       "vi",
       "emacs",
       "code",
-      "type"
+      "type",
+      // — the 22 that were missing —
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "awk",
+      "gawk",
+      "sed",
+      "cut",
+      "tr",
+      "jq",
+      "yq",
+      "od",
+      "xxd",
+      "hexdump",
+      "strings",
+      "sort",
+      "uniq",
+      "tac",
+      "nl",
+      "dd"
     ]);
-    FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+    FS_OP_PRESCREEN_RE = new RegExp(
+      `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+    );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
       ".npm/_npx",
@@ -3243,9 +3275,37 @@ var init_dist = __esm({
         // for the canonical test-asserted contract.
         rule: "shield:project-jail:block-read-env",
         reason: "Reading .env files is blocked by project-jail shield",
-        match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-          p
-        )
+        // Structural, not a list. The previous form enumerated seven suffixes and
+        // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+        // gitignored, all routinely holding real secrets — were never covered. A
+        // hand-written list of what to protect is only ever as complete as the day
+        // it was typed; this says "`.env` plus any suffix chain" and then names the
+        // exceptions, which is the direction that fails safe.
+        //
+        //   \.env          the segment itself
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //                  files. Without it a flat suffix class swallows both.
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+        //                  `(\.[\w-]+)*` reads the same but is rejected by
+        //                  safe-regex2, and this pattern runs on the hook hot path.
+        //
+        // The two exclusions are NOT the same shape, because the words do not mean
+        // the same thing:
+        //
+        //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+        //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+        //     These are checked into git by convention: already public, so blocking
+        //     them buys nothing and costs the most common legitimate agent read.
+        //
+        //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+        //     fixture. `.env.test` is the committed template and stays allowed, but
+        //     `.env.test.local` is gitignored by the `.env*.local` convention and
+        //     holds real values, so it must block. Using `\b` here — the obvious
+        //     symmetry — silently exempts every `.env.test.*` file.
+        //
+        // shields.test.ts:983-995 is the canonical contract; keep both in step.
+        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
       },
       {
         // verdict: 'review' (not 'block') is a deliberate design choice
@@ -4403,7 +4463,7 @@ var init_dist = __esm({
     REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
     MAX_PII_SCAN_BYTES = 1e5;
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
     DEDUPE_PREVIEW_LEN = 120;
     TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
     /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
@@ -49460,6 +49520,14 @@ function atLeastConfidence(c, min) {
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
+function scanCoveredEverything(value, depth = 0) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string") return value.length <= DLP_SCAN_LIMITS.maxStringBytes;
+  if (typeof value !== "object") return true;
+  if (depth >= DLP_SCAN_LIMITS.maxDepth) return false;
+  const children = Array.isArray(value) ? value : Object.values(value);
+  return children.every((child) => scanCoveredEverything(child, depth + 1));
+}
 function buildArgsField(rawInput) {
   let hashed = {};
   try {
@@ -49469,6 +49537,7 @@ function buildArgsField(rawInput) {
   try {
     const hit = scanArgs(rawInput);
     if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
+    if (!scanCoveredEverything(rawInput)) return { ...hashed, argsUnscanned: true };
     return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
   } catch {
     return hashed;

package/dist/cli.mjs

@@ -2643,7 +2643,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -3169,6 +3169,13 @@ var init_dist = __esm({
     MAX_DEPTH = 5;
     MAX_STRING_BYTES = 1e5;
     MAX_JSON_PARSE_BYTES = 1e4;
+    DLP_SCAN_LIMITS = {
+      /** Max characters examined per individual string field; the remainder of an
+       *  oversized string is NOT scanned. */
+      maxStringBytes: MAX_STRING_BYTES,
+      /** Max nesting depth walked; anything deeper is NOT scanned. */
+      maxDepth: MAX_DEPTH
+    };
     MAX_REGEX_LENGTH = 256;
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
@@ -3206,9 +3213,34 @@ var init_dist = __esm({
       "vi",
       "emacs",
       "code",
-      "type"
+      "type",
+      // — the 22 that were missing —
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "awk",
+      "gawk",
+      "sed",
+      "cut",
+      "tr",
+      "jq",
+      "yq",
+      "od",
+      "xxd",
+      "hexdump",
+      "strings",
+      "sort",
+      "uniq",
+      "tac",
+      "nl",
+      "dd"
     ]);
-    FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+    FS_OP_PRESCREEN_RE = new RegExp(
+      `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+    );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
       ".npm/_npx",
@@ -3247,9 +3279,37 @@ var init_dist = __esm({
         // for the canonical test-asserted contract.
         rule: "shield:project-jail:block-read-env",
         reason: "Reading .env files is blocked by project-jail shield",
-        match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-          p
-        )
+        // Structural, not a list. The previous form enumerated seven suffixes and
+        // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+        // gitignored, all routinely holding real secrets — were never covered. A
+        // hand-written list of what to protect is only ever as complete as the day
+        // it was typed; this says "`.env` plus any suffix chain" and then names the
+        // exceptions, which is the direction that fails safe.
+        //
+        //   \.env          the segment itself
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //                  files. Without it a flat suffix class swallows both.
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+        //                  `(\.[\w-]+)*` reads the same but is rejected by
+        //                  safe-regex2, and this pattern runs on the hook hot path.
+        //
+        // The two exclusions are NOT the same shape, because the words do not mean
+        // the same thing:
+        //
+        //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+        //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+        //     These are checked into git by convention: already public, so blocking
+        //     them buys nothing and costs the most common legitimate agent read.
+        //
+        //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+        //     fixture. `.env.test` is the committed template and stays allowed, but
+        //     `.env.test.local` is gitignored by the `.env*.local` convention and
+        //     holds real values, so it must block. Using `\b` here — the obvious
+        //     symmetry — silently exempts every `.env.test.*` file.
+        //
+        // shields.test.ts:983-995 is the canonical contract; keep both in step.
+        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
       },
       {
         // verdict: 'review' (not 'block') is a deliberate design choice
@@ -4407,7 +4467,7 @@ var init_dist = __esm({
     REALTIME_PII_PATTERNS = ["SSN", "Credit Card"];
     MAX_PII_SCAN_BYTES = 1e5;
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
     DEDUPE_PREVIEW_LEN = 120;
     TERMINAL_ESCAPE_RE = // eslint-disable-next-line no-control-regex
     /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[@-_]|[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
@@ -49453,6 +49513,14 @@ function atLeastConfidence(c, min) {
 function sanitize3(value) {
   return value.replace(/[\x00-\x1F\x7F]/g, "");
 }
+function scanCoveredEverything(value, depth = 0) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string") return value.length <= DLP_SCAN_LIMITS.maxStringBytes;
+  if (typeof value !== "object") return true;
+  if (depth >= DLP_SCAN_LIMITS.maxDepth) return false;
+  const children = Array.isArray(value) ? value : Object.values(value);
+  return children.every((child) => scanCoveredEverything(child, depth + 1));
+}
 function buildArgsField(rawInput) {
   let hashed = {};
   try {
@@ -49462,6 +49530,7 @@ function buildArgsField(rawInput) {
   try {
     const hit = scanArgs(rawInput);
     if (hit) return { ...hashed, dlpPattern: hit.patternName, dlpSample: hit.redactedSample };
+    if (!scanCoveredEverything(rawInput)) return { ...hashed, argsUnscanned: true };
     return { args: JSON.parse(redactSecrets(JSON.stringify(rawInput))) };
   } catch {
     return hashed;

package/dist/dashboard.mjs

@@ -1239,9 +1239,34 @@ var init_dist = __esm({
       "vi",
       "emacs",
       "code",
-      "type"
+      "type",
+      // — the 22 that were missing —
+      "grep",
+      "egrep",
+      "fgrep",
+      "rg",
+      "ag",
+      "ack",
+      "awk",
+      "gawk",
+      "sed",
+      "cut",
+      "tr",
+      "jq",
+      "yq",
+      "od",
+      "xxd",
+      "hexdump",
+      "strings",
+      "sort",
+      "uniq",
+      "tac",
+      "nl",
+      "dd"
     ]);
-    FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+    FS_OP_PRESCREEN_RE = new RegExp(
+      `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+    );
     HOME_CACHE_ALLOWLIST = [
       ".cache",
       ".npm/_npx",
@@ -1280,9 +1305,37 @@ var init_dist = __esm({
         // for the canonical test-asserted contract.
         rule: "shield:project-jail:block-read-env",
         reason: "Reading .env files is blocked by project-jail shield",
-        match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-          p
-        )
+        // Structural, not a list. The previous form enumerated seven suffixes and
+        // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+        // gitignored, all routinely holding real secrets — were never covered. A
+        // hand-written list of what to protect is only ever as complete as the day
+        // it was typed; this says "`.env` plus any suffix chain" and then names the
+        // exceptions, which is the direction that fails safe.
+        //
+        //   \.env          the segment itself
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //                  files. Without it a flat suffix class swallows both.
+        //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+        //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+        //                  `(\.[\w-]+)*` reads the same but is rejected by
+        //                  safe-regex2, and this pattern runs on the hook hot path.
+        //
+        // The two exclusions are NOT the same shape, because the words do not mean
+        // the same thing:
+        //
+        //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+        //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+        //     These are checked into git by convention: already public, so blocking
+        //     them buys nothing and costs the most common legitimate agent read.
+        //
+        //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+        //     fixture. `.env.test` is the committed template and stays allowed, but
+        //     `.env.test.local` is gitignored by the `.env*.local` convention and
+        //     holds real values, so it must block. Using `\b` here — the obvious
+        //     symmetry — silently exempts every `.env.test.*` file.
+        //
+        // shields.test.ts:983-995 is the canonical contract; keep both in step.
+        match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
       },
       {
         // verdict: 'review' (not 'block') is a deliberate design choice

package/dist/index.js

@@ -1371,9 +1371,34 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "vi",
   "emacs",
   "code",
-  "type"
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
 ]);
-var FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
   ".npm/_npx",
@@ -1412,9 +1437,37 @@ var SENSITIVE_PATH_RULES = [
     // for the canonical test-asserted contract.
     rule: "shield:project-jail:block-read-env",
     reason: "Reading .env files is blocked by project-jail shield",
-    match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-      p
-    )
+    // Structural, not a list. The previous form enumerated seven suffixes and
+    // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+    // gitignored, all routinely holding real secrets — were never covered. A
+    // hand-written list of what to protect is only ever as complete as the day
+    // it was typed; this says "`.env` plus any suffix chain" and then names the
+    // exceptions, which is the direction that fails safe.
+    //
+    //   \.env          the segment itself
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //                  files. Without it a flat suffix class swallows both.
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+    //                  `(\.[\w-]+)*` reads the same but is rejected by
+    //                  safe-regex2, and this pattern runs on the hook hot path.
+    //
+    // The two exclusions are NOT the same shape, because the words do not mean
+    // the same thing:
+    //
+    //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+    //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+    //     These are checked into git by convention: already public, so blocking
+    //     them buys nothing and costs the most common legitimate agent read.
+    //
+    //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+    //     fixture. `.env.test` is the committed template and stays allowed, but
+    //     `.env.test.local` is gitignored by the `.env*.local` convention and
+    //     holds real values, so it must block. Using `\b` here — the obvious
+    //     symmetry — silently exempts every `.env.test.*` file.
+    //
+    // shields.test.ts:983-995 is the canonical contract; keep both in step.
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice

package/dist/index.mjs

@@ -1341,9 +1341,34 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "vi",
   "emacs",
   "code",
-  "type"
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
 ]);
-var FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
   ".npm/_npx",
@@ -1382,9 +1407,37 @@ var SENSITIVE_PATH_RULES = [
     // for the canonical test-asserted contract.
     rule: "shield:project-jail:block-read-env",
     reason: "Reading .env files is blocked by project-jail shield",
-    match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-      p
-    )
+    // Structural, not a list. The previous form enumerated seven suffixes and
+    // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+    // gitignored, all routinely holding real secrets — were never covered. A
+    // hand-written list of what to protect is only ever as complete as the day
+    // it was typed; this says "`.env` plus any suffix chain" and then names the
+    // exceptions, which is the direction that fails safe.
+    //
+    //   \.env          the segment itself
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //                  files. Without it a flat suffix class swallows both.
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+    //                  `(\.[\w-]+)*` reads the same but is rejected by
+    //                  safe-regex2, and this pattern runs on the hook hot path.
+    //
+    // The two exclusions are NOT the same shape, because the words do not mean
+    // the same thing:
+    //
+    //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+    //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+    //     These are checked into git by convention: already public, so blocking
+    //     them buys nothing and costs the most common legitimate agent read.
+    //
+    //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+    //     fixture. `.env.test` is the committed template and stays allowed, but
+    //     `.env.test.local` is gitignored by the `.env*.local` convention and
+    //     holds real values, so it must block. Using `\b` here — the obvious
+    //     symmetry — silently exempts every `.env.test.*` file.
+    //
+    // shields.test.ts:983-995 is the canonical contract; keep both in step.
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice

package/dist/scan-ink.mjs

@@ -818,6 +818,48 @@ function assertBuiltinPatternsAreSafe() {
 assertBuiltinPatternsAreSafe();
 var { syntax } = mvdanSh;
 var sharedParser = syntax.NewParser();
+var FS_READ_TOOLS = /* @__PURE__ */ new Set([
+  "cat",
+  "less",
+  "head",
+  "tail",
+  "bat",
+  "more",
+  "open",
+  "print",
+  "nano",
+  "vim",
+  "vi",
+  "emacs",
+  "code",
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
+]);
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 function deriveRedirOp(sample) {
   try {
     const f = sharedParser.Parse(sample, "cmd");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.67.2",
+  "version": "1.67.4",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",