@node9/proxy 2.13.1 → 2.14.1

package/dist/scan-ink.mjs

@@ -812,12 +812,383 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "nl",
   "dd"
 ]);
+var GREP_SHAPE = {
+  takesValue: /* @__PURE__ */ new Set([
+    "-A",
+    "-B",
+    "-C",
+    "-D",
+    "-d",
+    "-e",
+    "-f",
+    "-m",
+    "--after-context",
+    "--before-context",
+    "--binary-files",
+    "--context",
+    "--devices",
+    "--directories",
+    "--exclude",
+    "--exclude-dir",
+    "--exclude-from",
+    "--file",
+    "--include",
+    "--label",
+    "--max-count",
+    "--regexp"
+  ]),
+  noValue: /* @__PURE__ */ new Set([
+    "-E",
+    "-F",
+    "-G",
+    "-P",
+    "-i",
+    "-y",
+    "-v",
+    "-V",
+    "-w",
+    "-x",
+    "-c",
+    "-l",
+    "-L",
+    "-o",
+    "-q",
+    "-s",
+    "-b",
+    "-H",
+    "-h",
+    "-n",
+    "-T",
+    "-Z",
+    "-z",
+    "-R",
+    "-r",
+    "-U",
+    "-u",
+    "-I",
+    "-a",
+    "--basic-regexp",
+    "--binary",
+    "--byte-offset",
+    "--color",
+    "--colour",
+    "--count",
+    "--dereference-recursive",
+    "--extended-regexp",
+    "--files-with-matches",
+    "--files-without-match",
+    "--fixed-strings",
+    "--help",
+    "--ignore-case",
+    "--initial-tab",
+    "--invert-match",
+    "--line-buffered",
+    "--line-number",
+    "--line-regexp",
+    "--no-filename",
+    "--no-group-separator",
+    "--no-ignore-case",
+    "--no-messages",
+    "--null",
+    "--null-data",
+    "--only-matching",
+    "--perl-regexp",
+    "--quiet",
+    "--recursive",
+    "--silent",
+    "--text",
+    "--version",
+    "--with-filename",
+    "--word-regexp"
+  ]),
+  patternFlags: /* @__PURE__ */ new Set(["-e", "--regexp"]),
+  noPatternFlags: /* @__PURE__ */ new Set(["-f", "--file"])
+};
+var PATTERN_VERBS = {
+  grep: GREP_SHAPE,
+  // /usr/bin/egrep and /usr/bin/fgrep are 41-byte shell wrappers that exec
+  // `grep -E` and `grep -F`. Read in full, not assumed.
+  egrep: GREP_SHAPE,
+  fgrep: GREP_SHAPE,
+  // ripgrep 14.1.1, complete from its own --help. An earlier comment here said rg
+  // was not installed on the measuring machine; it is, and that stale claim is why
+  // this table shipped incomplete for two rounds, blocking ordinary searches like
+  // `rg --sort-files .env src` (/code-review round 4).
+  rg: {
+    takesValue: /* @__PURE__ */ new Set([
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-E",
+      "-e",
+      "-f",
+      "-g",
+      "-j",
+      "-M",
+      "-m",
+      "-r",
+      "-t",
+      "-T",
+      "--after-context",
+      "--before-context",
+      "--color",
+      "--colors",
+      "--context",
+      "--context-separator",
+      "--dfa-size-limit",
+      "--encoding",
+      "--engine",
+      "--field-context-separator",
+      "--field-match-separator",
+      "--file",
+      "--generate",
+      "--glob",
+      "--hostname-bin",
+      "--hyperlink-format",
+      "--iglob",
+      "--ignore-file",
+      "--max-columns",
+      "--max-count",
+      "--max-depth",
+      // An ALIAS of --max-depth, and it takes a value. The round-5 extraction read
+      // alias lines as plain switches and swept it into noValue, which hard-blocked
+      // `rg --maxdepth 2 .env src` while `--max-depth 2` ran (/code-review round 7).
+      "--maxdepth",
+      "--max-filesize",
+      "--path-separator",
+      "--pre",
+      "--pre-glob",
+      "--regexp",
+      "--regex-size-limit",
+      "--replace",
+      "--sort",
+      "--sortr",
+      "--threads",
+      "--type",
+      "--type-add",
+      "--type-clear",
+      "--type-not"
+    ]),
+    noValue: /* @__PURE__ */ new Set([
+      "-.",
+      "-0",
+      "-a",
+      "-b",
+      "-c",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-P",
+      "-q",
+      "-s",
+      "-S",
+      "-u",
+      "-U",
+      "-v",
+      "-V",
+      "-w",
+      "-x",
+      "-z",
+      "--auto-hybrid-regex",
+      "--binary",
+      "--block-buffered",
+      "--byte-offset",
+      "--case-sensitive",
+      "--column",
+      "--count",
+      "--count-matches",
+      "--crlf",
+      "--debug",
+      "--files",
+      "--files-with-matches",
+      "--files-without-match",
+      "--fixed-strings",
+      "--follow",
+      "--glob-case-insensitive",
+      "--heading",
+      "--help",
+      "--hidden",
+      "--ignore-case",
+      "--ignore-file-case-insensitive",
+      "--include-zero",
+      "--invert-match",
+      "--json",
+      "--line-buffered",
+      "--line-number",
+      "--line-regexp",
+      "--max-columns-preview",
+      "--mmap",
+      "--multiline",
+      "--multiline-dotall",
+      "--no-column",
+      "--no-config",
+      "--no-context-separator",
+      "--no-encoding",
+      "--no-filename",
+      "--no-ignore",
+      "--no-ignore-dot",
+      "--no-ignore-exclude",
+      "--no-ignore-files",
+      "--no-ignore-global",
+      "--no-ignore-messages",
+      "--no-ignore-parent",
+      "--no-ignore-vcs",
+      "--no-line-number",
+      "--no-messages",
+      "--no-pcre2-unicode",
+      "--no-pre",
+      "--no-require-git",
+      "--no-unicode",
+      "--null",
+      "--null-data",
+      "--one-file-system",
+      "--only-matching",
+      "--passthru",
+      "--pcre2",
+      "--pcre2-version",
+      "--pretty",
+      "--print0",
+      "--quiet",
+      "--search-zip",
+      "--smart-case",
+      "--sort-files",
+      "--stats",
+      "--stop-on-nonmatch",
+      "--text",
+      "--trace",
+      "--trim",
+      "--type-list",
+      "--unrestricted",
+      "--version",
+      "--vimgrep",
+      "--with-filename",
+      "--word-regexp",
+      // The COMPLETE remainder of `rg --help`, added after /code-review round 5
+      // found 40 documented switches in neither set. The table is now the whole
+      // option list: `rg --help` yields 149 long options, 35 of them value-taking.
+      "--ignore",
+      "--ignore-dot",
+      "--ignore-exclude",
+      "--ignore-files",
+      "--ignore-global",
+      "--ignore-messages",
+      "--ignore-parent",
+      "--ignore-vcs",
+      "--messages",
+      "--no-auto-hybrid-regex",
+      "--no-binary",
+      "--no-block-buffered",
+      "--no-byte-offset",
+      "--no-crlf",
+      "--no-fixed-strings",
+      "--no-follow",
+      "--no-glob-case-insensitive",
+      "--no-heading",
+      "--no-hidden",
+      "--no-ignore-file-case-insensitive",
+      "--no-include-zero",
+      "--no-invert-match",
+      "--no-json",
+      "--no-line-buffered",
+      "--no-max-columns-preview",
+      "--no-mmap",
+      "--no-multiline",
+      "--no-multiline-dotall",
+      "--no-one-file-system",
+      "--no-pcre2",
+      "--no-search-zip",
+      "--no-sort-files",
+      "--no-stats",
+      "--no-text",
+      "--no-trim",
+      "--passthrough",
+      "--pcre2-unicode",
+      "--require-git",
+      "--unicode"
+    ]),
+    patternFlags: /* @__PURE__ */ new Set(["-e", "--regexp"]),
+    // `--files` and `--type-list` list or enumerate without a pattern. Founder
+    // decision 2026-09-13: `rg --files ~/.ssh` stays BLOCKED, which this achieves
+    // by leaving the directory in the judged list.
+    noPatternFlags: /* @__PURE__ */ new Set(["-f", "--file", "--files", "--type-list", "--pcre2-version"])
+  }
+};
+var PATTERN_VERB_NAMES = Object.keys(PATTERN_VERBS);
+var SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+var TAR_VALUE_LETTERS = ["b", "C", "f", "F", "g", "H", "I", "K", "L", "N", "T", "V", "X"];
+var ZIP_VALUE_LETTERS = ["b", "n", "P", "t", "s", "O", "x", "i"];
+var RSYNC_VALUE_LETTERS = ["e", "f", "T", "B", "M"];
+var RSYNC_SKIP = [
+  "e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--files-from",
+  "f",
+  "--filter"
+];
+var CP_VALUE_LETTERS = ["S", "t"];
+var INSTALL_VALUE_LETTERS = ["S", "t", "g", "m", "o"];
+var COPY_VERBS = {
+  cp: { source: "allButLast", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+  mv: { source: "allButLast", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+  install: { source: "allButLast", targetDirFlag: true, valueLetters: INSTALL_VALUE_LETTERS },
+  ln: { source: "first", targetDirFlag: true, valueLetters: CP_VALUE_LETTERS },
+  scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS, valueLetters: SCP_VALUE_FLAGS },
+  rsync: { source: "allButLast", skipFlags: RSYNC_SKIP, valueLetters: RSYNC_VALUE_LETTERS },
+  tar: {
+    source: "archive",
+    archive: "tar",
+    skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"],
+    valueLetters: TAR_VALUE_LETTERS
+  },
+  zip: {
+    source: "archive",
+    archive: "zip",
+    skipFlags: ["x", "i", "--exclude", "--include"],
+    valueLetters: ZIP_VALUE_LETTERS
+  },
+  ar: { source: "archive", archive: "ar" },
+  // 7z switches are INLINE only (`-mx9`, `-px`, `-x!pat`), so no following word is
+  // ever a switch's operand -- which is why the short `x` is NOT a skipFlag here
+  // and valueLetters is empty. Keeping the short `x` made `7z a out.7z -mx KEY`
+  // drop the credential as an exclusion operand (/code-review round 8), and the
+  // derived "every skipped letter is a value letter" row in jail-copy.spec.ts is
+  // what keeps the two tables honest about it.
+  "7z": { source: "archive", archive: "7z", skipFlags: ["--exclude"], valueLetters: [] },
+  gzip: { source: "all" },
+  bzip2: { source: "all" },
+  xz: { source: "all" },
+  "docker cp": { source: "allButLast" },
+  "kubectl cp": { source: "allButLast" },
+  "gsutil cp": { source: "allButLast" },
+  "gsutil rsync": { source: "allButLast" },
+  "rclone copy": { source: "allButLast" },
+  "rclone sync": { source: "allButLast" },
+  "aws s3 cp": { source: "allButLast" },
+  "aws s3 mv": { source: "allButLast" },
+  "aws s3 sync": { source: "allButLast" },
+  "gcloud storage cp": { source: "allButLast" },
+  "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+};
+var COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
 var FS_OP_PRESCREEN_RE = new RegExp(
   // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
   // reader right after `"` / `'`, and without these two characters the
   // prescreen rejected every string-wrapped read before the parser ran.
   // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
-  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 function deriveRedirOp(sample) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.13.1",
+  "version": "2.14.1",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",