@node9/proxy 2.12.0 → 2.13.1

package/dist/index.mjs

@@ -1132,13 +1132,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -1640,6 +1659,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -1648,7 +1671,11 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "dd"
 ]);
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -1669,12 +1696,12 @@ var SENSITIVE_PATH_RULES = [
   {
     rule: "shield:project-jail:block-read-ssh",
     reason: "Reading SSH private keys is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.ssh[\\/]/i.test(p)
+    match: (p) => /([\\/]\.ssh[\\/]|^\.ssh[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.ssh$)/i.test(p)
   },
   {
     rule: "shield:project-jail:block-read-aws",
     reason: "Reading AWS credentials is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.aws[\\/]/i.test(p)
+    match: (p) => /([\\/]\.aws[\\/]|^\.aws[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.aws$)/i.test(p)
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
@@ -1718,7 +1745,9 @@ var SENSITIVE_PATH_RULES = [
     //     symmetry — silently exempts every `.env.test.*` file.
     //
     // shields.test.ts:983-995 is the canonical contract; keep both in step.
-    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i.test(
+      p
+    )
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1929,15 +1958,14 @@ function listOps() {
   return _listOps;
 }
 var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
 function unwrapCommandHead(words) {
   let i = 0;
   while (i < words.length) {
     const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
     if (head === "find") {
-      const x = words.findIndex(
-        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
-      );
+      const x = words.findIndex((w, k) => k > i && w !== null && FIND_EXEC_FLAGS.has(w));
       if (x < 0) break;
       i = x + 1;
       continue;
@@ -1959,7 +1987,11 @@ function unwrapCommandHead(words) {
       if (t.startsWith("-")) {
         i++;
         const nxt = words[i];
-        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()) && // A reader is a command, never a flag's operand: `env - cat X`,
+        // `stdbuf -o0 cat X`, `ionice -c3 cat X`. Without this the head was
+        // swallowed and the jail needed a looser fallback whose cost was a
+        // false positive on `sudo echo cat X`.
+        !FS_READ_TOOLS.has(nxt.split("/").pop()?.toLowerCase() ?? ""))
           i++;
         continue;
       }
@@ -2080,36 +2112,29 @@ function isProtectedHomePath(rawPath) {
 }
 function extractLiteralArgs(callExpr) {
   const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [] };
-  const litFromWord = (w) => {
-    const parts = w?.Parts || [];
-    let s = "";
-    for (const p of parts) {
-      const t = syntax.NodeType(p);
-      if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-      else if (t === "SglQuoted") s += p.Value ?? "";
-      else if (t === "DblQuoted") {
-        const inner = p.Parts || [];
-        if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-        s += inner.map((ip) => ip.Value ?? "").join("");
-      } else {
-        return null;
-      }
-    }
-    return s;
-  };
-  const name = (litFromWord(args[0]) || "").toLowerCase();
+  if (args.length === 0) return { name: "", flags: [], paths: [], words: [] };
+  const words = args.map((a) => resolveWordLiteral(a));
+  const name = (words[0] ?? "").toLowerCase();
   const flags = [];
   const paths = [];
-  for (let i = 1; i < args.length; i++) {
-    const v = litFromWord(args[i]);
+  for (let i = 1; i < words.length; i++) {
+    const v = words[i];
     if (v === null) continue;
     if (v.startsWith("-")) flags.push(v);
     else paths.push(v);
   }
-  return { name, flags, paths };
+  return { name, flags, paths, words };
 }
-var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+var NET_BINARIES = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "scp",
+  "ssh",
+  "nc",
+  "ncat",
+  "netcat",
+  "rsync"
+]);
 var VALUE_FLAGS = {
   curl: /* @__PURE__ */ new Set([
     "-d",
@@ -2394,6 +2419,9 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
@@ -2458,16 +2486,21 @@ function isRmCreatedInCommandCleanup(command) {
   }
   return sawRm && ok;
 }
-function analyzeFsOperationImpl(command) {
+function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
   try {
     syntax.Walk(f, (node) => {
-      if (!node || result) return false;
+      if (!node || result?.verdict === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const { name, flags, paths } = extractLiteralArgs(n);
+      const nodeType = syntax.NodeType(n);
+      if (nodeType === "Stmt") {
+        result = stricter(result, jailedRedirectRead(n));
+        return result?.verdict !== "block";
+      }
+      if (nodeType !== "CallExpr") return true;
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2496,19 +2529,22 @@ function analyzeFsOperationImpl(command) {
           }
         }
       }
-      if (FS_READ_TOOLS.has(name)) {
-        for (const p of paths) {
-          for (const sp of SENSITIVE_PATH_RULES) {
-            if (sp.match(p)) {
-              result = {
-                ruleName: sp.rule,
-                verdict: sp.verdict ?? "block",
-                reason: sp.reason,
-                path: p
-              };
-              return false;
-            }
+      if (depth < 1) {
+        const payload = literalShellPayload(words, name);
+        if (payload !== null) {
+          const inner = analyzeFsOperationImpl(payload, depth + 1);
+          if (inner) {
+            result = inner;
+            return false;
           }
+          return true;
+        }
+      }
+      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      if (readPaths) {
+        for (const p of readPaths) {
+          result = stricter(result, matchSensitivePath2(p));
+          if (result?.verdict === "block") return false;
         }
       }
       return true;
@@ -2518,6 +2554,57 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function stricter(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return b.verdict === "block" && a.verdict !== "block" ? b : a;
+}
+function matchSensitivePath2(p) {
+  for (const sp of SENSITIVE_PATH_RULES) {
+    if (sp.match(p))
+      return { ruleName: sp.rule, verdict: sp.verdict ?? "block", reason: sp.reason, path: p };
+  }
+  return null;
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(w.split("/").pop()?.toLowerCase() ?? "");
+var positionalAfter = (words, from, to = words.length) => words.slice(from, to).filter((w) => w !== null && !w.startsWith("-"));
+function wrappedReadPaths(words, name) {
+  if (name === "find") {
+    const k = words.findIndex((w) => w !== null && FIND_EXEC_FLAGS.has(w));
+    if (k < 1 || !isReaderWord(words[k + 1] ?? null)) return null;
+    const firstPredicate = words.findIndex((w, i) => i > 0 && w !== null && w.startsWith("-"));
+    return positionalAfter(words, 1, firstPredicate > 0 ? firstPredicate : k);
+  }
+  if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
+  const h = unwrapCommandHead(words);
+  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+}
+function literalShellPayload(words, name) {
+  const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
+  const head = (words[h] ?? "").split("/").pop()?.toLowerCase() ?? "";
+  if (head === "eval") {
+    const rest = words.slice(h + 1);
+    if (rest.length === 0 || rest.some((w) => w === null)) return null;
+    return rest.join(" ");
+  }
+  if (SHELL_INTERPRETERS.has(head)) {
+    const c = words.findIndex((w, i) => i > h && w !== null && isInlineCodeFlag(head, w));
+    if (c < 0) return null;
+    return words[c + 1] ?? null;
+  }
+  return null;
+}
+function jailedRedirectRead(stmt) {
+  const redirs = stmt.Redirs || [];
+  for (const r of redirs) {
+    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    const p = resolveWordLiteral(r.Word);
+    if (p === null || p === "") continue;
+    const hit = matchSensitivePath2(p);
+    if (hit) return hit;
+  }
+  return null;
+}
 function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -2650,21 +2737,7 @@ function evaluateEgress(dests, policy) {
   }
   return review;
 }
-var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
-  "cat",
-  "head",
-  "tail",
-  "grep",
-  "awk",
-  "sed",
-  "cut",
-  "sort",
-  "tee",
-  "less",
-  "more",
-  "strings",
-  "xxd"
-]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
   "curl",
   "wget",
@@ -2695,16 +2768,25 @@ var OBFUSCATORS = /* @__PURE__ */ new Set([
   "node"
 ]);
 var SENSITIVE_PATTERNS = [
-  /(?:^|\/)\.env(?:\.|$)/i,
-  // .env, .env.local, .env.production
+  // Kept in step with the AST tier and dlp/ -- see jail-both-doors.test.ts.
+  /(?:^|\/)\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env chain; fixtures exempt unless .local
   /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
   // SSH private keys
   /\.pem$|\.key$|\.p12$|\.pfx$/i,
   // certificate files
-  /(?:^|\/)\.ssh\//i,
-  // ~/.ssh/ directory
-  /(?:^|\/)\.aws\/credentials/i,
-  // AWS credentials
+  // The `$` half mirrors shell/index.ts's SENSITIVE_PATH_RULES: a file INSIDE
+  // the directory counts wherever it appears, while the directory ITSELF counts
+  // only when the path is ROOTED (`~/.ssh`, `/home/u/.ssh`) -- an unrooted
+  // `config/.ssh` is more likely a search pattern than a read. These are
+  // extracted TOKENS (see `args.some(isSensitivePath)` below), the same input
+  // contract as the shell tier, so the same boundary is the right one.
+  // Without it `grep -r x ~/.ssh | curl -d @-` scored one tier BELOW the
+  // identical pipeline naming a file inside that directory.
+  /(?:^|\/)\.ssh\/|^(?:[~/]|[A-Za-z]:).*\/\.ssh$/i,
+  // ~/.ssh/ and ~/.ssh
+  /(?:^|\/)\.aws\/credentials|^(?:[~/]|[A-Za-z]:).*\/\.aws$/i,
+  // AWS creds + dir
   /(?:^|\/)\.netrc$/i,
   // netrc (stores HTTP credentials)
   /(?:^|\/)(passwd|shadow|sudoers)$/i,
@@ -2738,8 +2820,8 @@ function splitOnPipe(cmd) {
   if (current.trim()) segments2.push(current.trim());
   return segments2.filter(Boolean);
 }
-function positionalTokens(segment) {
-  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+function positionalTokens(tokens) {
+  return tokens.slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
   const segments2 = splitOnPipe(command);
@@ -2762,8 +2844,10 @@ function analyzePipeChain(command) {
   for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
-    const binary = tokens[0].toLowerCase();
-    const args = positionalTokens(segment);
+    const h = unwrapCommandHead(tokens);
+    const head = h < tokens.length ? h : 0;
+    const binary = tokens[head].toLowerCase();
+    const args = positionalTokens(tokens.slice(head));
     if (SOURCE_COMMANDS.has(binary)) {
       sourceFiles.push(...args);
       if (args.some(isSensitivePath)) hasSensitiveSource = true;
@@ -4162,7 +4246,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -4176,7 +4260,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -4190,7 +4274,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -4204,7 +4288,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -4218,7 +4302,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -4232,7 +4316,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -4246,7 +4330,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],
@@ -7023,12 +7107,13 @@ function extractFilePaths(toolName, args) {
   }
   return paths.filter(Boolean);
 }
+var NETWORK_COMMAND_RE = new RegExp(`(?<![.\\w-])(${[...NET_BINARIES].join("|")})\\b`);
 function isNetworkTool(toolName, args) {
   const t = toolName.toLowerCase();
   if (t === "bash" || t === "shell" || t === "run_shell_command" || t === "terminal.execute") {
     const a = args;
     const cmd = typeof a?.command === "string" ? a.command : typeof a?.cmd === "string" ? a.cmd : "";
-    return /\b(curl|wget|scp|rsync|nc|ncat|netcat|ssh)\b/.test(cmd);
+    return NETWORK_COMMAND_RE.test(cmd);
   }
   return false;
 }

package/dist/scan-ink.mjs

@@ -709,13 +709,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -782,6 +801,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -790,7 +813,11 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "dd"
 ]);
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 function deriveRedirOp(sample) {
   try {
@@ -807,10 +834,14 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
 ]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",
@@ -1362,7 +1393,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -1376,7 +1407,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -1390,7 +1421,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -1404,7 +1435,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -1418,7 +1449,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -1432,7 +1463,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -1446,7 +1477,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.12.0",
+  "version": "2.13.1",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",