@node9/proxy 2.22.1 → 2.23.1

package/dist/index.mjs

@@ -1595,6 +1595,7 @@ function normalizeCommandForPolicyImpl(command) {
         const source = command.slice(s, e);
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
+        if (/^[;&|()<>]+$/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
         const quoteOnly = source.replace(/['"]/g, "");
         if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
@@ -2611,6 +2612,60 @@ var NET_BINARIES = /* @__PURE__ */ new Set([
   "rsync"
 ]);
 var VALUE_FLAGS = {
+  // rsync 3.2.7, its own --help: every flag whose operand could be mistaken for
+  // a host. `-e ssh` is the one that matters most (`ssh` is not the destination).
+  rsync: /* @__PURE__ */ new Set([
+    "-e",
+    "--rsh",
+    "-f",
+    "--filter",
+    "-T",
+    "--temp-dir",
+    "-B",
+    "--block-size",
+    "-M",
+    "--remote-option",
+    "--exclude",
+    "--exclude-from",
+    "--include",
+    "--include-from",
+    "--files-from",
+    "--compare-dest",
+    "--copy-dest",
+    "--link-dest",
+    "--partial-dir",
+    "--log-file",
+    "--password-file",
+    "--bwlimit",
+    "--timeout",
+    "--contimeout",
+    "--port",
+    "--sockopts",
+    "--address",
+    "--chmod",
+    "--chown",
+    "--max-size",
+    "--min-size",
+    "--modify-window",
+    "--out-format",
+    "--log-file-format",
+    "--backup-dir",
+    "--suffix",
+    "--iconv",
+    "--max-delete",
+    "--checksum-choice",
+    "--info",
+    "--debug",
+    "--stderr",
+    "--outbuf",
+    "--skip-compress",
+    "--usermap",
+    "--groupmap",
+    "--mkpath",
+    "--write-batch",
+    "--read-batch",
+    "--only-write-batch"
+  ]),
   curl: /* @__PURE__ */ new Set([
     "-d",
     "--data",
@@ -2694,23 +2749,163 @@ var VALUE_FLAGS = {
   ]),
   nc: /* @__PURE__ */ new Set(["-p", "-s", "-w", "-X", "-x", "-e", "-g", "-G", "-i", "-O", "-T", "-q", "-m"])
 };
+var HOME_VARIABLES = /* @__PURE__ */ new Set(["HOME", "USERPROFILE"]);
+var assignmentTable = null;
+var currentStmtOffset = Number.MAX_SAFE_INTEGER;
+var PAYLOAD_BUDGET = 256;
+var payloadBudget = 0;
+var seenPayloads = null;
+function payloadKey(payload) {
+  if (!assignmentTable || assignmentTable.size === 0) return payload;
+  const bindings = [];
+  for (const [name, rec] of assignmentTable) {
+    if (rec.value !== null) bindings.push(`${name}=${rec.value}`);
+  }
+  return `${payload}\0${bindings.sort().join("
")}`;
+}
+function claimPayload(payload) {
+  if (!seenPayloads) return "ok";
+  const key = payloadKey(payload);
+  if (seenPayloads.has(key)) return "seen";
+  if (payloadBudget <= 0) return "exhausted";
+  payloadBudget--;
+  seenPayloads.add(key);
+  return "ok";
+}
+var UNANALYSABLE_NESTING = {
+  ruleName: "review-unanalysable-nesting",
+  verdict: "review",
+  reason: "This command nests more wrapped shell payloads than the policy engine will unwrap, so some of what it runs was not read.",
+  path: ""
+};
+var ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
+function recordTopLevelAssignments(f) {
+  const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+  for (const stmt of stmts) recordTopLevelStmt(stmt);
+}
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+var AND_OP = probeBinOp("a && b");
+var OR_OP = probeBinOp("a || b");
+var AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
+function recordTopLevelStmt(stmt) {
+  if (!stmt || !stmt.Cmd) return false;
+  const t = syntax.NodeType(stmt.Cmd);
+  if (t === "BinaryCmd") {
+    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
+    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    return true;
+  }
+  if (t !== "CallExpr" && t !== "DeclClause") return false;
+  let at = 0;
+  try {
+    at = stmt.Pos().Offset();
+  } catch {
+    at = 0;
+  }
+  recordAssignments(stmt.Cmd, at);
+  if (stmt.Negated) return false;
+  if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
+  return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
+}
+function recordAssignments(n, at) {
+  if (!assignmentTable) return;
+  const t = syntax.NodeType(n);
+  let assigns = [];
+  if (t === "CallExpr") {
+    if ((n.Args || []).length > 0) return;
+    assigns = n.Assigns || [];
+  } else if (t === "DeclClause") {
+    if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
+    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+  } else return;
+  for (const a of assigns) {
+    const name = a?.Name?.Value;
+    if (!name || !a.Value || a.Append) continue;
+    assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
+  }
+}
+function resolveTrivialSubst(part) {
+  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  const stmts = part.Stmts || [];
+  if (stmts.length !== 1) return void 0;
+  const st = stmts[0];
+  if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
+  const cmd = st.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if ((cmd.Assigns || []).length > 0) return void 0;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return void 0;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.slice(i).join(" ");
+  }
+  if (head === "printf") {
+    if (rest.length !== 2) return void 0;
+    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
+    return rest[1];
+  }
+  return void 0;
+}
+function recordedExpansion(name) {
+  if (!assignmentTable || !name) return void 0;
+  const rec = assignmentTable.get(name);
+  if (rec === void 0 || rec.at >= currentStmtOffset) return void 0;
+  return rec.value;
+}
+function isPlainParam(p) {
+  if (syntax.NodeType(p) !== "ParamExp") return false;
+  return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
+}
+function expandPlainParam(p) {
+  if (!assignmentTable) return void 0;
+  if (!isPlainParam(p)) return void 0;
+  const recorded = recordedExpansion(p.Param?.Value);
+  if (recorded !== void 0) return recorded;
+  return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
+}
 function resolveWordLiteral(w) {
   const parts = w?.Parts || [];
   let s = "";
   for (const p of parts) {
-    const t = syntax.NodeType(p);
-    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-    else if (t === "SglQuoted") s += p.Value ?? "";
-    else if (t === "DblQuoted") {
-      const inner = p.Parts || [];
-      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-      s += inner.map((ip) => ip.Value ?? "").join("");
-    } else {
-      return null;
-    }
+    const piece = resolvePart(p, false);
+    if (piece === void 0 || piece === null) return null;
+    s += piece;
   }
   return s;
 }
+function resolvePart(p, inQuotes) {
+  const t = syntax.NodeType(p);
+  if (t === "Lit") {
+    const raw = p.Value ?? "";
+    if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
+    return assignmentTable ? raw.replace(/\\([$`"\\])/g, "$1") : raw;
+  }
+  if (t === "SglQuoted") return p.Value ?? "";
+  if (t === "ParamExp") return expandPlainParam(p);
+  if (t === "CmdSubst") return assignmentTable ? resolveTrivialSubst(p) : void 0;
+  if (t === "DblQuoted" && !inQuotes) {
+    const inner = p.Parts || [];
+    let out = "";
+    for (const ip of inner) {
+      const piece = resolvePart(ip, true);
+      if (piece === void 0 || piece === null) return piece;
+      out += piece;
+    }
+    return out;
+  }
+  return void 0;
+}
 function parseDestHost(token) {
   if (!token) return null;
   let t = token.trim();
@@ -2765,6 +2960,7 @@ function destTokensForBinary(binary, args) {
     case "ssh":
       return positionals.slice(0, 1);
     case "scp":
+    case "rsync":
       return positionals.filter((p) => p.includes(":") || p.includes("@"));
     case "nc":
     case "ncat":
@@ -2965,17 +3161,35 @@ function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
+  const outerTable = assignmentTable;
+  const outerOffset = currentStmtOffset;
+  const outerSeen = seenPayloads;
+  const outerBudget = payloadBudget;
+  if (depth === 0) {
+    seenPayloads = /* @__PURE__ */ new Set();
+    payloadBudget = PAYLOAD_BUDGET;
+  }
+  assignmentTable = new Map(
+    [...outerTable ?? []].map(([k, r]) => [k, { value: r.value, at: -1 }])
+  );
+  currentStmtOffset = Number.MAX_SAFE_INTEGER;
   try {
+    recordTopLevelAssignments(f);
     syntax.Walk(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
       const nodeType = syntax.NodeType(n);
       if (nodeType === "Stmt") {
+        try {
+          currentStmtOffset = n.Pos().Offset();
+        } catch {
+          currentStmtOffset = Number.MAX_SAFE_INTEGER;
+        }
         result = stricter(result, jailedRedirectRead(n));
         return result?.verdict !== "block";
       }
       if (nodeType !== "CallExpr") return true;
-      const { name, flags, paths, words, args } = extractLiteralArgs(n);
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -3004,9 +3218,30 @@ function analyzeFsOperationImpl(command, depth = 0) {
           }
         }
       }
-      if (depth < 1) {
+      if (depth < 24 && name === "find") {
+        for (const action of findActions(words, 0)) {
+          const h = unwrapCommandHead(action);
+          const inner = literalShellPayload(action.slice(h), baseWord(action[h]));
+          if (inner === null) continue;
+          const claim = claimPayload(inner);
+          if (claim === "exhausted") {
+            result = stricter(result, UNANALYSABLE_NESTING);
+            continue;
+          }
+          if (claim === "seen") continue;
+          const v = analyzeFsOperationImpl(inner, depth + 1);
+          result = stricter(result, v);
+          if (result?.verdict === "block") return false;
+        }
+      }
+      if (depth < 24) {
         const payload = literalShellPayload(words, name);
-        if (payload !== null) {
+        const claim = payload === null ? "seen" : claimPayload(payload);
+        if (claim === "exhausted") {
+          result = stricter(result, UNANALYSABLE_NESTING);
+          return true;
+        }
+        if (payload !== null && claim === "ok") {
           const inner = analyzeFsOperationImpl(payload, depth + 1);
           if (inner) {
             result = inner;
@@ -3015,7 +3250,7 @@ function analyzeFsOperationImpl(command, depth = 0) {
           return true;
         }
       }
-      const readPaths = FS_READ_TOOLS.has(name) ? [...readTargets(name, args, flags, words, 1), ...flagOperandFiles(name, words, 1)] : wrappedReadPaths(words, name);
+      const readPaths = FS_READ_TOOLS.has(name) ? readerPaths(words, 0) : wrappedReadPaths(words, name);
       if (readPaths) {
         for (const p of readPaths) {
           result = stricter(result, matchSensitivePath2(p));
@@ -3030,6 +3265,11 @@ function analyzeFsOperationImpl(command, depth = 0) {
     return result;
   } catch {
     return null;
+  } finally {
+    assignmentTable = outerTable;
+    currentStmtOffset = outerOffset;
+    seenPayloads = outerSeen;
+    if (depth === 0) payloadBudget = outerBudget;
   }
 }
 function stricter(a, b) {
@@ -3087,6 +3327,18 @@ function resolveCopyShape(words, h) {
   return null;
 }
 var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findAction(words, k) {
+  const end = words.findIndex((w, i) => i > k && (w === ";" || w === "+"));
+  return words.slice(k + 1, end < 0 ? words.length : end);
+}
+function findActions(words, h) {
+  const out = [];
+  for (let i = h + 1; i < words.length; i++) {
+    const w = words[i];
+    if (w !== null && FIND_EXEC_FLAGS.has(w)) out.push(findAction(words, i));
+  }
+  return out;
+}
 function findStartPoints(words, h) {
   const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
   if (k < 0) return { k, starts: [] };
@@ -3102,8 +3354,13 @@ function copySourcePaths(words) {
   if (fi >= 0) {
     const { k, starts } = findStartPoints(words, fi);
     if (k < 0) return [];
-    const action = unwrapCommandHead(words.slice(k + 1));
-    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+    const out = [];
+    for (const action of findActions(words, fi)) {
+      const h2 = unwrapCommandHead(action);
+      if (!resolveCopyShape(action, h2)) continue;
+      out.push(...starts, ...copySourcePaths(action));
+    }
+    return out;
   }
   if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
   const r = resolveCopyShape(words, h);
@@ -3290,6 +3547,15 @@ function flagEffect(token, shape, known) {
   }
   return NONE;
 }
+function readerPaths(words, h) {
+  const head = baseWord(words[h]);
+  const from = h + 1;
+  const flags = words.slice(from).filter((w) => w !== null && w.startsWith("-"));
+  return [
+    ...readTargets(head, positionedArgs(words, from), flags, words, from),
+    ...flagOperandFiles(head, words, from)
+  ];
+}
 function readTargets(verb, args, flags, words = [], from = 1) {
   const shape = PATTERN_VERBS[verb];
   if (!shape) return args.map((a) => a.value);
@@ -3371,18 +3637,21 @@ function flagOperandFiles(verb, words, from) {
 function wrappedReadPaths(words, name) {
   if (name === "find") {
     const { k, starts } = findStartPoints(words, 0);
-    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+    if (k < 0) return null;
+    const paths = [];
+    let reads = false;
+    for (const action of findActions(words, 0)) {
+      const h2 = unwrapCommandHead(action);
+      if (!isReaderWord(action[h2] ?? null)) continue;
+      reads = true;
+      paths.push(...readerPaths(action, h2));
+    }
+    return reads ? [...starts, ...paths] : paths;
   }
   if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
   const h = unwrapCommandHead(words);
   if (h <= 0 || !isReaderWord(words[h] ?? null)) return null;
-  const head = baseWord(words[h]);
-  const rest = words.slice(h + 1);
-  const restFlags = rest.filter((w) => w !== null && w.startsWith("-"));
-  return [
-    ...readTargets(head, positionedArgs(words, h + 1), restFlags, words, h + 1),
-    ...flagOperandFiles(head, words, h + 1)
-  ];
+  return readerPaths(words, h);
 }
 function literalShellPayload(words, name) {
   const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;

package/dist/scan-ink.mjs

@@ -1211,6 +1211,18 @@ var FS_OP_PRESCREEN_RE = new RegExp(
   // Dogfound 2026-09-22; pinned by verb-case-coverage.spec.ts.
   "i"
 );
+var currentStmtOffset = Number.MAX_SAFE_INTEGER;
+function probeBinOp(src) {
+  try {
+    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
+    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+  } catch {
+  }
+  return null;
+}
+var AND_OP = probeBinOp("a && b");
+var OR_OP = probeBinOp("a || b");
+var AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
 function deriveRedirOp(sample) {
   try {
     const f = sharedParser.Parse(sample, "cmd");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.22.1",
+  "version": "2.23.1",
   "description": "IAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",