@node9/proxy 2.13.0 → 2.14.0

package/dist/scan-ink.mjs

@@ -709,13 +709,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -782,6 +801,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -789,8 +812,55 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "nl",
   "dd"
 ]);
+var SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+var RSYNC_SKIP = [
+  "e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--files-from",
+  "f",
+  "--filter"
+];
+var COPY_VERBS = {
+  cp: { source: "allButLast", targetDirFlag: true },
+  mv: { source: "allButLast", targetDirFlag: true },
+  install: { source: "allButLast", targetDirFlag: true },
+  ln: { source: "first", targetDirFlag: true },
+  scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
+  rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+  tar: {
+    source: "archive",
+    archive: "tar",
+    skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+  },
+  zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
+  ar: { source: "archive", archive: "ar" },
+  "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+  gzip: { source: "all" },
+  bzip2: { source: "all" },
+  xz: { source: "all" },
+  "docker cp": { source: "allButLast" },
+  "kubectl cp": { source: "allButLast" },
+  "gsutil cp": { source: "allButLast" },
+  "gsutil rsync": { source: "allButLast" },
+  "rclone copy": { source: "allButLast" },
+  "rclone sync": { source: "allButLast" },
+  "aws s3 cp": { source: "allButLast" },
+  "aws s3 mv": { source: "allButLast" },
+  "aws s3 sync": { source: "allButLast" },
+  "gcloud storage cp": { source: "allButLast" },
+  "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+};
+var COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 function deriveRedirOp(sample) {
   try {
@@ -807,10 +877,14 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
 ]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var aws_default = {
   name: "aws",
   description: "Protects AWS infrastructure from destructive AI operations",
@@ -1362,7 +1436,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -1376,7 +1450,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -1390,7 +1464,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -1404,7 +1478,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -1418,7 +1492,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -1432,7 +1506,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -1446,7 +1520,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",