@node9/proxy 2.33.1 → 2.34.0

package/dist/scan-ink.mjs

@@ -1039,6 +1039,11 @@ var CHECK_TEXT = {
     example: "cat /etc/shadow",
     advice: "Keep Review, or choose Block when agents must never read system password hashes."
   },
+  "files.system-dirs": {
+    plain: "The agent writes, creates or deletes a file in a system directory, or sends a system file in a request. /usr/local and a container working directory under /usr/src are ordinary project space and are not included.",
+    example: "wget -O /usr/bin/tool https://example.com/tool",
+    advice: "Keep Review on a workstation. A container image build that installs into /usr can set it to Log."
+  },
   // ── Commands ──────────────────────────────────────────────────────────────
   "commands.inline-exec": {
     plain: "The agent runs a small program written inside the command itself.",
@@ -1235,7 +1240,7 @@ var CHECK_TEXT = {
     advice: "Fixed at Block. A person accepts the change on the machine (node9 mcp pin update)."
   },
   "loading.malicious-package": {
-    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago.",
+    plain: "The agent installs a package that the public malicious-package database (OSV) lists, or one published minutes ago. Covers npm, PyPI, RubyGems, crates.io, Go, NuGet, Maven, Packagist and VS Code extensions; the publish-age and install-script signals are npm and PyPI only.",
     example: "npm install of a package flagged as malware",
     advice: "Keep Block for known-malicious packages; brand-new packages already stop for Review."
   }
@@ -1272,6 +1277,15 @@ var PRODUCT_CHECKS = [
     defaultValue: "review",
     legacy: ["review-password-hash-read"]
   },
+  {
+    id: "files.system-dirs",
+    group: "files",
+    title: "System directories",
+    catches: "Writes, new files and removals under /usr, /etc, /boot, /bin, /sbin, /lib and /var/log, and uploads of system files",
+    values: ALL,
+    defaultValue: "review",
+    legacy: ["review-system-dir-mutation", "review-system-file-upload"]
+  },
   // ── Commands ────────────────────────────────────────────────────────────
   {
     id: "commands.inline-exec",
@@ -2222,6 +2236,17 @@ var DEFAULT_OPS = new Set(
     (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
   )
 );
+var SYSTEM_DIRS = [
+  "/usr",
+  "/etc",
+  "/boot",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/var/log"
+];
+var UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
 var LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
 var BIP39_ENGLISH = `abandon
 ability
@@ -4493,6 +4518,7 @@ var REFERENCE_VALUE_RE = /^[$@%]|^(?:process\.env|os\.environ|env|config|setting
 var IDENTIFIER_VALUE_RE = /^[A-Za-z_.-]+$/;
 var PATH_VALUE_RE = /^(?:\/|\.{1,2}\/|~\/)/;
 var DOTTED_REFERENCE_RE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/;
+var CONCATENATION_RE = /^\+[A-Za-z_$][\w$]*\./;
 var EMAIL_VALUE_RE = /^[^@\s]+@[^@\s]+\.[A-Za-z]{2,}$/;
 function looksLikeJoinedWords(value) {
   const segments2 = value.replace(/[0-9]/g, "").split(/[-_.]/);
@@ -4523,26 +4549,32 @@ function looksGenerated(value, minLength, minEntropy, lettersOnlyAllowed = false
   if (EMAIL_VALUE_RE.test(value)) return false;
   if (looksLikeJoinedWords(value) || hasSequentialRun(value)) return false;
   if (PATH_VALUE_RE.test(value) || DOTTED_REFERENCE_RE.test(value)) return false;
+  if (CONCATENATION_RE.test(value)) return false;
   if (rejectedByStructuredValidator(value)) return false;
   return shannonEntropy(value) >= minEntropy;
 }
 var FIXTURE_NAME_RE = /(?:fake|dummy|example|sample|mock|stub|placeholder|test)/i;
-var DERIVATIVE_NAME_RE = /(?:hash|digest|id|type|name|url|uri|path|file|len|length|count|size|ttl|expires?|expiry|age|date|time|format|field|header|param)$/i;
+var DERIVATIVE_NAME_RE = /(?:hash|digest|fingerprint|thumbprint|checksum|id|type|name|url|uri|path|file|len|length|count|size|ttl|expires?|expiry|age|date|time|format|field|header|param)$/i;
 function nameHoldsCredential(name) {
   return !FIXTURE_NAME_RE.test(name) && !DERIVATIVE_NAME_RE.test(name);
 }
 var QUERY_CREDENTIAL_VALUE_RE = /=([A-Za-z0-9%+/_.~-]{8,512}={0,2})$/;
 var OTP_SECRET_RE = /^[A-Z2-7]{16,}=*$/i;
+var OTP_DOC_SECRETS = /* @__PURE__ */ new Set(["JBSWY3DPEHPK3PXP", "GEZDGNBVGY3TQOJQ"]);
+function isOtpDocSecret(value) {
+  return OTP_DOC_SECRETS.has(value.replace(/=+$/, "").toUpperCase());
+}
 function validateQueryCredential(raw) {
   const value = capturedValue(raw, QUERY_CREDENTIAL_VALUE_RE);
   if (value === null) return false;
-  if (OTP_SECRET_RE.test(value)) return looksGenerated(value, 16, 3, true);
+  if (OTP_SECRET_RE.test(value))
+    return !isOtpDocSecret(value) && looksGenerated(value, 16, 3, true);
   if (!/[0-9]/.test(value) || !/[A-Za-z]/.test(value)) return false;
   return looksGenerated(value, 12, 3);
 }
-var ASSIGNED_SECRET_VALUE_RE = /(?::=|=>|[:=])[ \t]{0,8}["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})$/;
+var ASSIGNED_SECRET_VALUE_RE = /(?::=|=>|[:=])[ \t]{0,8}\\?["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})$/;
 var ASSIGNED_SECRET_NAME_RE = /^([A-Za-z0-9_]+)/;
-var NAME_KEYWORD_RE = /^(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret)/i;
+var NAME_KEYWORD_RE = /^(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|consumer[_-]?key|app[_-]?key|signing[_-]?key|encryption[_-]?key|master[_-]?key|jsapi[_-]?ticket|pass)/i;
 function keywordEndsAPart(name) {
   const keyword = name.match(NAME_KEYWORD_RE)?.[0];
   if (!keyword) return false;
@@ -4554,13 +4586,43 @@ function keywordEndsAPart(name) {
 var ARN_CONTEXT_RE = /\barn:[A-Za-z0-9-]*:[^\s"'`]*$/i;
 function validateAssignedSecret(raw, before = "") {
   const value = capturedValue(raw, ASSIGNED_SECRET_VALUE_RE);
-  const name = capturedValue(raw, ASSIGNED_SECRET_NAME_RE);
+  const name = capturedValue(raw, ASSIGNED_SECRET_NAME_RE)?.replace(/^_+/, "") ?? null;
   if (value === null || name === null) return false;
-  if (!keywordEndsAPart(name) || ARN_CONTEXT_RE.test(before)) return false;
-  const prefix = before.match(/[A-Za-z0-9_]*$/)?.[0] ?? "";
+  if (!keywordEndsAPart(name)) return false;
+  if (ARN_CONTEXT_RE.test(before)) return false;
+  const prefix = (before.match(/[A-Za-z0-9_]*$/)?.[0] ?? "") + (raw.startsWith("_") ? "_" : "");
   if (!nameHoldsCredential(prefix + name)) return false;
   return looksGenerated(value, 12, 3.5);
 }
+var BASIC_VALUE_RE = /([A-Za-z0-9+/]{8,512}={0,2})$/;
+var BASIC_PAIR_RE = /^([^:\s]{1,128}):(\S{8,256})$/;
+function validateBasicCredential(raw) {
+  const b64 = capturedValue(raw, BASIC_VALUE_RE);
+  if (b64 === null) return false;
+  const bare = b64.replace(/=+$/, "");
+  if (bare.length % 4 === 1) return false;
+  const bytes = Buffer.from(b64, "base64");
+  if (bytes.toString("base64").replace(/=+$/, "") !== bare) return false;
+  const text = bytes.toString("utf8");
+  if (!Buffer.from(text, "utf8").equals(bytes)) return false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 32 || c === 127) return false;
+  }
+  const pair = BASIC_PAIR_RE.exec(text);
+  if (!pair) return false;
+  const password = pair[2];
+  if (!/[0-9]/.test(password) || !/[A-Za-z]/.test(password)) return false;
+  const lower2 = password.toLowerCase();
+  if (DLP_STOPWORDS.some((sw) => lower2.includes(sw)) || hasSequentialRun(password)) return false;
+  return shannonEntropy(password) >= 3;
+}
+var OTP_CAPTURE_RE = /["']([A-Z2-7]{16,128}=*)["']$/i;
+function validateOtpSecret(raw) {
+  const secret = capturedValue(raw, OTP_CAPTURE_RE);
+  if (secret === null || isOtpDocSecret(secret)) return false;
+  return looksGenerated(secret.replace(/=+$/, ""), 16, 3, true);
+}
 var DLP_PATTERNS = [
   // ── AWS ───────────────────────────────────────────────────────────────────
   {
@@ -4898,6 +4960,22 @@ var DLP_PATTERNS = [
     contextBoost: true,
     minEntropy: 3
   },
+  // ── HTTP Basic credential ─────────────────────────────────────────────────
+  // `Authorization: Basic <base64 of user:password>`, or the bare scheme in a
+  // config list. The validator decodes the value and accepts only a
+  // `user:password` whose password looks generated (letters and digits, 8+
+  // characters, the query-credential rule), so prose ("Basic authentication")
+  // and documentation pairs (`admin:changeme`, `user:pass1234`) stay allowed.
+  // review: the same weight as a bare Bearer token.
+  {
+    name: "HTTP Basic Credential",
+    regex: /\bBasic[ \t]{1,8}([A-Za-z0-9+/]{8,512}={0,2})/i,
+    severity: "review",
+    keywords: ["basic"],
+    validate: validateBasicCredential,
+    redactGroup: 1,
+    argumentsOnly: true
+  },
   // ── Resend ────────────────────────────────────────────────────────────────
   {
     name: "Resend API Key",
@@ -5039,6 +5117,19 @@ var DLP_PATTERNS = [
     validate: validateQueryCredential,
     argumentsOnly: true
   },
+  // ── OTP secret in a constructor ───────────────────────────────────────────
+  // `ROTP::TOTP.new('<base32>')`, `pyotp.TOTP("<base32>")`, `new HOTP('...')`:
+  // the shared secret of a one-time-password generator written as a literal.
+  // The otpauth URI form is `Credential in URL Query`. review.
+  {
+    name: "OTP Secret",
+    regex: /\b(?:TOTP|HOTP|OTP)(?:\.new|\.create)?[ \t]{0,8}\(?[ \t]{0,8}["']([A-Z2-7]{16,128}=*)["']/i,
+    severity: "review",
+    keywords: ["otp"],
+    validate: validateOtpSecret,
+    redactGroup: 1,
+    argumentsOnly: true
+  },
   // ── Secret assigned to a telling name ─────────────────────────────────────
   // `password: ...`, `JWT_SECRET=...`, `api_key = "..."`. The name alone is
   // not a finding: most such lines hold a reference (`process.env.X`), a
@@ -5046,12 +5137,14 @@ var DLP_PATTERNS = [
   // generated: 12+ characters, not an identifier, Shannon entropy of 3.5
   // bits per character or more. review, never block (node9Firewall#348,
   // item 4). Tuned on CredData's public split; its look-alike lines are the
-  // negative control.
+  // negative control. A quote may be escaped (`\"access_token\":\"...\"`):
+  // JSON written inside a string literal. The two optional quotes after the
+  // name are written out, not as a counted group, to keep star height 1.
   {
     name: "Assigned Secret",
-    regex: /(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret)[A-Za-z0-9_]{0,40}["'\]]{0,2}[ \t]{0,8}(?::=|=>|[:=])[ \t]{0,8}["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})/i,
+    regex: /(?:password|passphrase|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|consumer[_-]?key|app[_-]?key|signing[_-]?key|encryption[_-]?key|master[_-]?key|jsapi[_-]?ticket|\bpass(?![A-Za-z0-9])|_pass(?![A-Za-z0-9]))[A-Za-z0-9_]{0,40}\\?["'\]]?\\?["'\]]?[ \t]{0,8}(?::=|=>|[:=])[ \t]{0,8}\\?["'`]?([A-Za-z0-9+/_.!@#$%^*~-]{12,512}={0,2})/i,
     severity: "review",
-    keywords: ["password", "passphrase", "passwd", "pwd", "secret", "token", "key"],
+    keywords: ["pass", "pwd", "secret", "token", "key", "ticket"],
     validate: validateAssignedSecret,
     argumentsOnly: true
   }
@@ -5126,6 +5219,35 @@ function assertBuiltinPatternsAreSafe() {
 }
 assertBuiltinPatternsAreSafe();
 var { syntax: syntax3 } = mvdanSh3;
+var EDITOR_HEADS = ["code", "code-insiders", "codium", "vscodium", "cursor"];
+var MANAGER_HEADS = /* @__PURE__ */ new Set([
+  "gem",
+  "bundle",
+  "cargo",
+  "go",
+  "dotnet",
+  "nuget",
+  "mvn",
+  "mvnw",
+  "composer",
+  ...EDITOR_HEADS,
+  "npm",
+  "npx",
+  "pnpm",
+  "yarn",
+  "bun",
+  "bunx",
+  "pip",
+  "pip3",
+  "pipx",
+  "python",
+  "python3",
+  "py",
+  "uv",
+  "uvx",
+  "poetry",
+  "pipenv"
+]);
 var TUNING_FIELDS = [
   { checkId: "network.unknown-host", name: "allow", legacy: ["egress", "allow"] },
   { checkId: "network.unknown-host", name: "deny", legacy: ["egress", "deny"] },
@@ -5184,6 +5306,7 @@ var TUNING_FIELDS = [
 var MAP_GOVERNED = /* @__PURE__ */ new Set([
   "files.shell-startup",
   "files.password-hashes",
+  "files.system-dirs",
   "commands.inline-exec",
   "commands.eval-dynamic",
   "commands.curl-pipe-shell",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.33.1",
+  "version": "2.34.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",