@node9/proxy 2.13.1 → 2.14.0

package/dist/index.js

@@ -1700,12 +1700,56 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "nl",
   "dd"
 ]);
+var SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+var RSYNC_SKIP = [
+  "e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--files-from",
+  "f",
+  "--filter"
+];
+var COPY_VERBS = {
+  cp: { source: "allButLast", targetDirFlag: true },
+  mv: { source: "allButLast", targetDirFlag: true },
+  install: { source: "allButLast", targetDirFlag: true },
+  ln: { source: "first", targetDirFlag: true },
+  scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
+  rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+  tar: {
+    source: "archive",
+    archive: "tar",
+    skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+  },
+  zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
+  ar: { source: "archive", archive: "ar" },
+  "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+  gzip: { source: "all" },
+  bzip2: { source: "all" },
+  xz: { source: "all" },
+  "docker cp": { source: "allButLast" },
+  "kubectl cp": { source: "allButLast" },
+  "gsutil cp": { source: "allButLast" },
+  "gsutil rsync": { source: "allButLast" },
+  "rclone copy": { source: "allButLast" },
+  "rclone sync": { source: "allButLast" },
+  "aws s3 cp": { source: "allButLast" },
+  "aws s3 mv": { source: "allButLast" },
+  "aws s3 sync": { source: "allButLast" },
+  "gcloud storage cp": { source: "allButLast" },
+  "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+};
+var TAR_MODE_WORD = /^[a-zA-Z]+$/;
+var COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
 var FS_OP_PRESCREEN_RE = new RegExp(
   // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -2140,20 +2184,32 @@ function isProtectedHomePath(rawPath) {
   }
   return true;
 }
-function extractLiteralArgs(callExpr) {
-  const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [], words: [] };
-  const words = args.map((a) => resolveWordLiteral(a));
-  const name = (words[0] ?? "").toLowerCase();
-  const flags = [];
-  const paths = [];
-  for (let i = 1; i < words.length; i++) {
+function positionedArgs(words, from = 1, to = words.length) {
+  const out = [];
+  let afterFlag = null;
+  for (let i = from; i < to; i++) {
     const v = words[i];
-    if (v === null) continue;
-    if (v.startsWith("-")) flags.push(v);
-    else paths.push(v);
+    if (v === null) {
+      afterFlag = null;
+      continue;
+    }
+    if (v.startsWith("-")) {
+      afterFlag = v;
+      continue;
+    }
+    out.push({ value: v, index: out.length, argv: i, afterFlag });
+    afterFlag = null;
   }
-  return { name, flags, paths, words };
+  return out;
+}
+function extractLiteralArgs(callExpr) {
+  const rawArgs = callExpr.Args || [];
+  if (rawArgs.length === 0) return { name: "", flags: [], paths: [], words: [], args: [] };
+  const words = rawArgs.map((a) => resolveWordLiteral(a));
+  const name = baseWord(words[0]);
+  const flags = words.slice(1).filter((w) => w !== null && w.startsWith("-"));
+  const args = positionedArgs(words);
+  return { name, flags, paths: args.map((a) => a.value), words, args };
 }
 var NET_BINARIES = /* @__PURE__ */ new Set([
   "curl",
@@ -2577,6 +2633,9 @@ function analyzeFsOperationImpl(command, depth = 0) {
           if (result?.verdict === "block") return false;
         }
       }
+      for (const p of copySourcePaths(words)) {
+        result = stricter(result, copyVerdictOf(matchSensitivePath2(p)));
+      }
       return true;
     });
     return result;
@@ -2589,6 +2648,140 @@ function stricter(a, b) {
   if (!b) return a;
   return b.verdict === "block" && a.verdict !== "block" ? b : a;
 }
+function flagInfo(w) {
+  if (w.startsWith("--")) {
+    const eq = w.indexOf("=");
+    return eq < 0 ? { letter: null, long: w, attached: null } : { letter: null, long: w.slice(0, eq), attached: w.slice(eq + 1) };
+  }
+  const m = /^-([a-zA-Z]+)(.*)$/.exec(w);
+  if (!m) return { letter: null, long: null, attached: null };
+  return { letter: m[1][m[1].length - 1], long: null, attached: m[2] === "" ? null : m[2] };
+}
+function flagIs(w, names) {
+  if (w === null) return false;
+  const f = flagInfo(w);
+  return names.some((n) => n.startsWith("--") ? f.long === n : f.letter === n);
+}
+function operandOf(a, names) {
+  if (!names || a.afterFlag === null) return false;
+  return flagIs(a.afterFlag, names) && flagInfo(a.afterFlag).attached === null;
+}
+function resolveCopyShape(words, h) {
+  const verb = baseWord(words[h]);
+  if (!verb) return null;
+  const direct = COPY_VERBS[verb];
+  if (direct) return { shape: direct, last: h };
+  const slots = positionedArgs(words, h + 1);
+  for (let i = 0; i < slots.length; i++) {
+    for (let n = 3; n >= 1; n--) {
+      const part = slots.slice(i, i + n);
+      if (part.length < n) continue;
+      const key = [verb, ...part.map((a) => a.value.toLowerCase())].join(" ");
+      const shape = COPY_VERBS[key];
+      if (shape) return { shape, last: part[n - 1].argv };
+    }
+    if (slots[i].afterFlag === null) return null;
+  }
+  return null;
+}
+var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findStartPoints(words, h) {
+  const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
+  if (k < 0) return { k, starts: [] };
+  const firstPredicate = words.findIndex(
+    (w, i) => i > h && w !== null && w.startsWith("-") && !FIND_OPTIONS.has(w)
+  );
+  const end = firstPredicate > h ? firstPredicate : k;
+  return { k, starts: positionalAfter(words, h + 1, end) };
+}
+function copySourcePaths(words) {
+  const h = unwrapCommandHead(words);
+  const fi = words.findIndex((w, i) => i <= h && baseWord(w) === "find");
+  if (fi >= 0) {
+    const { k, starts } = findStartPoints(words, fi);
+    if (k < 0) return [];
+    const action = unwrapCommandHead(words.slice(k + 1));
+    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+  }
+  if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
+  const r = resolveCopyShape(words, h);
+  if (!r) return [];
+  const { shape, last } = r;
+  const args = positionedArgs(words, last + 1);
+  const tail = words.slice(last + 1);
+  const skipped = (a) => operandOf(a, shape.skipFlags);
+  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && flagIs(w, ["t", "--target-directory"]));
+  const targetOperand = (a) => targetDir && operandOf(a, ["t", "--target-directory"]);
+  const lastOperand = [...tail].reverse().find((w) => w === null || !w.startsWith("-"));
+  const dynamicDest = lastOperand === null;
+  const destIsLastOperand = (shape.source === "allButLast" || shape.source === "first") && !targetDir && !dynamicDest;
+  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand))
+    return [];
+  let src;
+  switch (shape.source) {
+    case "all":
+      src = args;
+      break;
+    case "first":
+      src = targetDir ? args : args.slice(0, 1);
+      break;
+    case "flagOperand": {
+      const inline = tail.filter((w) => w !== null && w.startsWith("--")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && (shape.sourceFlags ?? []).includes(f.long ?? "")).map((f) => f.attached);
+      return [
+        ...args.filter(
+          (a) => flagIs(a.afterFlag, shape.sourceFlags ?? []) && flagInfo(a.afterFlag).attached === null
+        ).map((a) => a.value),
+        ...inline
+      ];
+    }
+    case "archive":
+      src = archiveInputs(shape.archive, args, tail);
+      break;
+    case "allButLast":
+      src = targetDir || dynamicDest ? args : args.slice(0, -1);
+      break;
+  }
+  return src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+}
+function archiveInputs(kind, args, tail) {
+  const first = args[0];
+  const bareKey = first && first.afterFlag === null && TAR_MODE_WORD.test(first.value);
+  if (kind === "tar") {
+    const flagsText = tail.filter((w) => w !== null && w.startsWith("-")).join(" ");
+    const mode = (bareKey ? first.value : "") + flagsText;
+    const extracting = /x|t/.test(bareKey ? first.value.replace(/f/g, "") : "") || /(^|\s)-[a-zA-Z]*[xt]|--extract|--list|--get/.test(flagsText);
+    const writing = /[cruA]/.test(bareKey ? first.value : "") || /(^|\s)-[a-zA-Z]*[cruA]|--create|--append|--update|--concatenate/.test(flagsText);
+    if (extracting && !writing) return [];
+    void mode;
+    let i = 0;
+    if (bareKey) {
+      i = 1;
+      const next = args[1];
+      if (first.value.includes("f") && next && next.afterFlag === null) i = 2;
+    }
+    return args.slice(i);
+  }
+  if (kind === "zip") return first && first.afterFlag === "-" ? args : args.slice(1);
+  if (kind === "ar") return bareKey ? args.slice(2) : args.slice(1);
+  return args.slice(2);
+}
+var COPY_RULE_OF = {
+  "shield:project-jail:block-read-ssh": "shield:project-jail:review-copy-ssh",
+  "shield:project-jail:block-read-aws": "shield:project-jail:review-copy-aws",
+  "shield:project-jail:block-read-env": "shield:project-jail:review-copy-env",
+  "shield:project-jail:review-read-credentials": "shield:project-jail:review-copy-credentials"
+};
+function copyVerdictOf(hit) {
+  if (!hit) return null;
+  const ruleName = COPY_RULE_OF[hit.ruleName];
+  if (!ruleName) return null;
+  return {
+    ruleName,
+    verdict: "review",
+    reason: `Copying ${hit.path} moves a credential out of its jail (project-jail shield)`,
+    path: hit.path
+  };
+}
 function matchSensitivePath2(p) {
   for (const sp of SENSITIVE_PATH_RULES) {
     if (sp.match(p))
@@ -2596,14 +2789,15 @@ function matchSensitivePath2(p) {
   }
   return null;
 }
-var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(w.split("/").pop()?.toLowerCase() ?? "");
-var positionalAfter = (words, from, to = words.length) => words.slice(from, to).filter((w) => w !== null && !w.startsWith("-"));
+function baseWord(w) {
+  return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
+var positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
 function wrappedReadPaths(words, name) {
   if (name === "find") {
-    const k = words.findIndex((w) => w !== null && FIND_EXEC_FLAGS.has(w));
-    if (k < 1 || !isReaderWord(words[k + 1] ?? null)) return null;
-    const firstPredicate = words.findIndex((w, i) => i > 0 && w !== null && w.startsWith("-"));
-    return positionalAfter(words, 1, firstPredicate > 0 ? firstPredicate : k);
+    const { k, starts } = findStartPoints(words, 0);
+    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
@@ -3464,6 +3658,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
+  let pendingAstReview;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -3475,7 +3670,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     if (fsVerdict) {
       const isShieldRule = fsVerdict.ruleName.startsWith("shield:");
       const labelPrefix = isShieldRule ? "project-jail (AST)" : "Node9 (AST)";
-      return {
+      const astVerdict = {
         decision: fsVerdict.verdict,
         blockedByLabel: `${labelPrefix}: ${fsVerdict.ruleName}`,
         reason: fsVerdict.reason,
@@ -3483,6 +3678,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleName: fsVerdict.ruleName,
         ruleDescription: fsVerdict.reason
       };
+      if (fsVerdict.verdict === "block") return astVerdict;
+      pendingAstReview = astVerdict;
     }
     const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
     const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
@@ -3525,7 +3722,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
       if (matchedRule.verdict === "allow")
-        return { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
+        return pendingAstReview ?? { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
       return {
         decision: matchedRule.verdict,
         blockedByLabel: `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`,
@@ -3552,6 +3749,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
     const candidates = [];
+    if (pendingAstReview) candidates.push(pendingAstReview);
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {

package/dist/index.mjs

@@ -1670,12 +1670,56 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "nl",
   "dd"
 ]);
+var SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+var RSYNC_SKIP = [
+  "e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--files-from",
+  "f",
+  "--filter"
+];
+var COPY_VERBS = {
+  cp: { source: "allButLast", targetDirFlag: true },
+  mv: { source: "allButLast", targetDirFlag: true },
+  install: { source: "allButLast", targetDirFlag: true },
+  ln: { source: "first", targetDirFlag: true },
+  scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
+  rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+  tar: {
+    source: "archive",
+    archive: "tar",
+    skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+  },
+  zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
+  ar: { source: "archive", archive: "ar" },
+  "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+  gzip: { source: "all" },
+  bzip2: { source: "all" },
+  xz: { source: "all" },
+  "docker cp": { source: "allButLast" },
+  "kubectl cp": { source: "allButLast" },
+  "gsutil cp": { source: "allButLast" },
+  "gsutil rsync": { source: "allButLast" },
+  "rclone copy": { source: "allButLast" },
+  "rclone sync": { source: "allButLast" },
+  "aws s3 cp": { source: "allButLast" },
+  "aws s3 mv": { source: "allButLast" },
+  "aws s3 sync": { source: "allButLast" },
+  "gcloud storage cp": { source: "allButLast" },
+  "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+};
+var TAR_MODE_WORD = /^[a-zA-Z]+$/;
+var COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
 var FS_OP_PRESCREEN_RE = new RegExp(
   // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -2110,20 +2154,32 @@ function isProtectedHomePath(rawPath) {
   }
   return true;
 }
-function extractLiteralArgs(callExpr) {
-  const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [], words: [] };
-  const words = args.map((a) => resolveWordLiteral(a));
-  const name = (words[0] ?? "").toLowerCase();
-  const flags = [];
-  const paths = [];
-  for (let i = 1; i < words.length; i++) {
+function positionedArgs(words, from = 1, to = words.length) {
+  const out = [];
+  let afterFlag = null;
+  for (let i = from; i < to; i++) {
     const v = words[i];
-    if (v === null) continue;
-    if (v.startsWith("-")) flags.push(v);
-    else paths.push(v);
+    if (v === null) {
+      afterFlag = null;
+      continue;
+    }
+    if (v.startsWith("-")) {
+      afterFlag = v;
+      continue;
+    }
+    out.push({ value: v, index: out.length, argv: i, afterFlag });
+    afterFlag = null;
   }
-  return { name, flags, paths, words };
+  return out;
+}
+function extractLiteralArgs(callExpr) {
+  const rawArgs = callExpr.Args || [];
+  if (rawArgs.length === 0) return { name: "", flags: [], paths: [], words: [], args: [] };
+  const words = rawArgs.map((a) => resolveWordLiteral(a));
+  const name = baseWord(words[0]);
+  const flags = words.slice(1).filter((w) => w !== null && w.startsWith("-"));
+  const args = positionedArgs(words);
+  return { name, flags, paths: args.map((a) => a.value), words, args };
 }
 var NET_BINARIES = /* @__PURE__ */ new Set([
   "curl",
@@ -2547,6 +2603,9 @@ function analyzeFsOperationImpl(command, depth = 0) {
           if (result?.verdict === "block") return false;
         }
       }
+      for (const p of copySourcePaths(words)) {
+        result = stricter(result, copyVerdictOf(matchSensitivePath2(p)));
+      }
       return true;
     });
     return result;
@@ -2559,6 +2618,140 @@ function stricter(a, b) {
   if (!b) return a;
   return b.verdict === "block" && a.verdict !== "block" ? b : a;
 }
+function flagInfo(w) {
+  if (w.startsWith("--")) {
+    const eq = w.indexOf("=");
+    return eq < 0 ? { letter: null, long: w, attached: null } : { letter: null, long: w.slice(0, eq), attached: w.slice(eq + 1) };
+  }
+  const m = /^-([a-zA-Z]+)(.*)$/.exec(w);
+  if (!m) return { letter: null, long: null, attached: null };
+  return { letter: m[1][m[1].length - 1], long: null, attached: m[2] === "" ? null : m[2] };
+}
+function flagIs(w, names) {
+  if (w === null) return false;
+  const f = flagInfo(w);
+  return names.some((n) => n.startsWith("--") ? f.long === n : f.letter === n);
+}
+function operandOf(a, names) {
+  if (!names || a.afterFlag === null) return false;
+  return flagIs(a.afterFlag, names) && flagInfo(a.afterFlag).attached === null;
+}
+function resolveCopyShape(words, h) {
+  const verb = baseWord(words[h]);
+  if (!verb) return null;
+  const direct = COPY_VERBS[verb];
+  if (direct) return { shape: direct, last: h };
+  const slots = positionedArgs(words, h + 1);
+  for (let i = 0; i < slots.length; i++) {
+    for (let n = 3; n >= 1; n--) {
+      const part = slots.slice(i, i + n);
+      if (part.length < n) continue;
+      const key = [verb, ...part.map((a) => a.value.toLowerCase())].join(" ");
+      const shape = COPY_VERBS[key];
+      if (shape) return { shape, last: part[n - 1].argv };
+    }
+    if (slots[i].afterFlag === null) return null;
+  }
+  return null;
+}
+var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findStartPoints(words, h) {
+  const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
+  if (k < 0) return { k, starts: [] };
+  const firstPredicate = words.findIndex(
+    (w, i) => i > h && w !== null && w.startsWith("-") && !FIND_OPTIONS.has(w)
+  );
+  const end = firstPredicate > h ? firstPredicate : k;
+  return { k, starts: positionalAfter(words, h + 1, end) };
+}
+function copySourcePaths(words) {
+  const h = unwrapCommandHead(words);
+  const fi = words.findIndex((w, i) => i <= h && baseWord(w) === "find");
+  if (fi >= 0) {
+    const { k, starts } = findStartPoints(words, fi);
+    if (k < 0) return [];
+    const action = unwrapCommandHead(words.slice(k + 1));
+    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+  }
+  if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
+  const r = resolveCopyShape(words, h);
+  if (!r) return [];
+  const { shape, last } = r;
+  const args = positionedArgs(words, last + 1);
+  const tail = words.slice(last + 1);
+  const skipped = (a) => operandOf(a, shape.skipFlags);
+  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && flagIs(w, ["t", "--target-directory"]));
+  const targetOperand = (a) => targetDir && operandOf(a, ["t", "--target-directory"]);
+  const lastOperand = [...tail].reverse().find((w) => w === null || !w.startsWith("-"));
+  const dynamicDest = lastOperand === null;
+  const destIsLastOperand = (shape.source === "allButLast" || shape.source === "first") && !targetDir && !dynamicDest;
+  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand))
+    return [];
+  let src;
+  switch (shape.source) {
+    case "all":
+      src = args;
+      break;
+    case "first":
+      src = targetDir ? args : args.slice(0, 1);
+      break;
+    case "flagOperand": {
+      const inline = tail.filter((w) => w !== null && w.startsWith("--")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && (shape.sourceFlags ?? []).includes(f.long ?? "")).map((f) => f.attached);
+      return [
+        ...args.filter(
+          (a) => flagIs(a.afterFlag, shape.sourceFlags ?? []) && flagInfo(a.afterFlag).attached === null
+        ).map((a) => a.value),
+        ...inline
+      ];
+    }
+    case "archive":
+      src = archiveInputs(shape.archive, args, tail);
+      break;
+    case "allButLast":
+      src = targetDir || dynamicDest ? args : args.slice(0, -1);
+      break;
+  }
+  return src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+}
+function archiveInputs(kind, args, tail) {
+  const first = args[0];
+  const bareKey = first && first.afterFlag === null && TAR_MODE_WORD.test(first.value);
+  if (kind === "tar") {
+    const flagsText = tail.filter((w) => w !== null && w.startsWith("-")).join(" ");
+    const mode = (bareKey ? first.value : "") + flagsText;
+    const extracting = /x|t/.test(bareKey ? first.value.replace(/f/g, "") : "") || /(^|\s)-[a-zA-Z]*[xt]|--extract|--list|--get/.test(flagsText);
+    const writing = /[cruA]/.test(bareKey ? first.value : "") || /(^|\s)-[a-zA-Z]*[cruA]|--create|--append|--update|--concatenate/.test(flagsText);
+    if (extracting && !writing) return [];
+    void mode;
+    let i = 0;
+    if (bareKey) {
+      i = 1;
+      const next = args[1];
+      if (first.value.includes("f") && next && next.afterFlag === null) i = 2;
+    }
+    return args.slice(i);
+  }
+  if (kind === "zip") return first && first.afterFlag === "-" ? args : args.slice(1);
+  if (kind === "ar") return bareKey ? args.slice(2) : args.slice(1);
+  return args.slice(2);
+}
+var COPY_RULE_OF = {
+  "shield:project-jail:block-read-ssh": "shield:project-jail:review-copy-ssh",
+  "shield:project-jail:block-read-aws": "shield:project-jail:review-copy-aws",
+  "shield:project-jail:block-read-env": "shield:project-jail:review-copy-env",
+  "shield:project-jail:review-read-credentials": "shield:project-jail:review-copy-credentials"
+};
+function copyVerdictOf(hit) {
+  if (!hit) return null;
+  const ruleName = COPY_RULE_OF[hit.ruleName];
+  if (!ruleName) return null;
+  return {
+    ruleName,
+    verdict: "review",
+    reason: `Copying ${hit.path} moves a credential out of its jail (project-jail shield)`,
+    path: hit.path
+  };
+}
 function matchSensitivePath2(p) {
   for (const sp of SENSITIVE_PATH_RULES) {
     if (sp.match(p))
@@ -2566,14 +2759,15 @@ function matchSensitivePath2(p) {
   }
   return null;
 }
-var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(w.split("/").pop()?.toLowerCase() ?? "");
-var positionalAfter = (words, from, to = words.length) => words.slice(from, to).filter((w) => w !== null && !w.startsWith("-"));
+function baseWord(w) {
+  return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
+var positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
 function wrappedReadPaths(words, name) {
   if (name === "find") {
-    const k = words.findIndex((w) => w !== null && FIND_EXEC_FLAGS.has(w));
-    if (k < 1 || !isReaderWord(words[k + 1] ?? null)) return null;
-    const firstPredicate = words.findIndex((w, i) => i > 0 && w !== null && w.startsWith("-"));
-    return positionalAfter(words, 1, firstPredicate > 0 ? firstPredicate : k);
+    const { k, starts } = findStartPoints(words, 0);
+    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
@@ -3434,6 +3628,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
+  let pendingAstReview;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -3445,7 +3640,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     if (fsVerdict) {
       const isShieldRule = fsVerdict.ruleName.startsWith("shield:");
       const labelPrefix = isShieldRule ? "project-jail (AST)" : "Node9 (AST)";
-      return {
+      const astVerdict = {
         decision: fsVerdict.verdict,
         blockedByLabel: `${labelPrefix}: ${fsVerdict.ruleName}`,
         reason: fsVerdict.reason,
@@ -3453,6 +3648,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleName: fsVerdict.ruleName,
         ruleDescription: fsVerdict.reason
       };
+      if (fsVerdict.verdict === "block") return astVerdict;
+      pendingAstReview = astVerdict;
     }
     const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
     const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
@@ -3495,7 +3692,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
       if (matchedRule.verdict === "allow")
-        return { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
+        return pendingAstReview ?? { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
       return {
         decision: matchedRule.verdict,
         blockedByLabel: `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`,
@@ -3522,6 +3719,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
     const candidates = [];
+    if (pendingAstReview) candidates.push(pendingAstReview);
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {