@node9/proxy 2.46.1 → 2.47.0

package/dist/scan-ink.mjs

@@ -237,20 +237,14 @@ import path from "path";
 import os from "os";
 
 // packages/policy-engine/dist/index.mjs
-import mvdanSh3 from "mvdan-sh";
 import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
-import mvdanSh from "mvdan-sh";
 import mvdanSh2 from "mvdan-sh";
+import mvdanSh from "mvdan-sh";
+import mvdanSh3 from "mvdan-sh";
 import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
-import mvdanSh4 from "mvdan-sh";
-import mvdanSh5 from "mvdan-sh";
-import mvdanSh6 from "mvdan-sh";
-import mvdanSh8 from "mvdan-sh";
-import mvdanSh7 from "mvdan-sh";
-import mvdanSh9 from "mvdan-sh";
 var MAX_REGEX_LENGTH = 256;
 function validateRegex(pattern) {
   if (!pattern) return "Pattern is required";
@@ -2940,6 +2934,117 @@ function isLockedCheck(def) {
 var LEGACY_TO_ID = new Map(
   CHECKS.flatMap((c) => (c.legacy ?? []).map((l) => [l, c.id]))
 );
+var { syntax } = mvdanSh;
+var KINDS = {
+  File: { nodes: ["Stmts"] },
+  Stmt: { nodes: ["Cmd", "Redirs"], scalars: ["Negated", "Background", "Coprocess"] },
+  CallExpr: { nodes: ["Assigns", "Args"] },
+  Assign: { nodes: ["Name", "Value", "Index", "Array"], scalars: ["Append", "Naked"] },
+  Word: { nodes: ["Parts"] },
+  Lit: { scalars: ["Value"] },
+  SglQuoted: { scalars: ["Value", "Dollar"] },
+  DblQuoted: { nodes: ["Parts"], scalars: ["Dollar"] },
+  ParamExp: {
+    nodes: ["Param", "Index", "Slice", "Repl", "Exp"],
+    scalars: ["Short", "Excl", "Length", "Width"]
+  },
+  CmdSubst: { nodes: ["Stmts"], scalars: ["Backquotes", "TempFile", "ReplyVar"] },
+  ArithmExp: { nodes: ["X"], scalars: ["Bracket", "Unsigned"] },
+  ArithmCmd: { nodes: ["X"], scalars: ["Unsigned"] },
+  ProcSubst: { nodes: ["Stmts"], scalars: ["Op"] },
+  ExtGlob: { nodes: ["Pattern"], scalars: ["Op"] },
+  BraceExp: { nodes: ["Elems"], scalars: ["Sequence"] },
+  // only with SplitBraces, unused here
+  BinaryCmd: { nodes: ["X", "Y"], scalars: ["Op"] },
+  BinaryArithm: { nodes: ["X", "Y"], scalars: ["Op"] },
+  UnaryArithm: { nodes: ["X"], scalars: ["Op", "Post"] },
+  ParenArithm: { nodes: ["X"] },
+  BinaryTest: { nodes: ["X", "Y"], scalars: ["Op"] },
+  UnaryTest: { nodes: ["X"], scalars: ["Op"] },
+  ParenTest: { nodes: ["X"] },
+  Redirect: { nodes: ["N", "Word", "Hdoc"], scalars: ["Op"] },
+  Block: { nodes: ["Stmts"] },
+  Subshell: { nodes: ["Stmts"] },
+  IfClause: { nodes: ["Cond", "Then", "Else"] },
+  WhileClause: { nodes: ["Cond", "Do"], scalars: ["Until"] },
+  ForClause: { nodes: ["Loop", "Do"], scalars: ["Select"] },
+  WordIter: { nodes: ["Name", "Items"] },
+  CStyleLoop: { nodes: ["Init", "Cond", "Post"] },
+  CaseClause: { nodes: ["Word", "Items"] },
+  CaseItem: { nodes: ["Patterns", "Stmts"], scalars: ["Op"] },
+  FuncDecl: { nodes: ["Name", "Body"], scalars: ["RsrvWord"] },
+  DeclClause: { nodes: ["Variant", "Args"], notWalked: ["Variant"] },
+  LetClause: { nodes: ["Exprs"] },
+  TimeClause: { nodes: ["Stmt"], scalars: ["PosixFormat"] },
+  CoprocClause: { nodes: ["Name", "Stmt"] },
+  TestClause: { nodes: ["X"] },
+  TestDecl: { nodes: ["Description", "Body"] },
+  ArrayExpr: { nodes: ["Elems"] },
+  ArrayElem: { nodes: ["Index", "Value"] },
+  Comment: { scalars: ["Text"] }
+};
+var STRUCTS = {
+  "ParamExp.Slice": { nodes: ["Offset", "Length"], notWalked: ["Offset", "Length"] },
+  "ParamExp.Repl": { nodes: ["Orig", "With"], scalars: ["All"] },
+  "ParamExp.Exp": { nodes: ["Word"], scalars: ["Op"] }
+};
+var unknownKinds = /* @__PURE__ */ new Set();
+function isGoNode(v) {
+  return v !== null && typeof v === "object" && typeof v.Pos === "function";
+}
+function toPlainTree(goNode) {
+  const kind = syntax.NodeType(goNode);
+  const out = { kind, pos: goNode.Pos().Offset(), end: goNode.End().Offset() };
+  const spec = KINDS[kind];
+  if (!spec) {
+    unknownKinds.add(kind);
+    return out;
+  }
+  convertFields(goNode, spec, out, kind);
+  return out;
+}
+function convertFields(goNode, spec, out, kind) {
+  for (const f of spec.scalars ?? []) out[f] = goNode[f];
+  for (const f of spec.nodes ?? []) {
+    const v = goNode[f];
+    if (v === void 0 || v === null) {
+      out[f] = null;
+    } else if (Array.isArray(v)) {
+      out[f] = v.map((c) => isGoNode(c) ? toPlainTree(c) : c);
+    } else if (isGoNode(v)) {
+      out[f] = toPlainTree(v);
+    } else if (typeof v === "object" && STRUCTS[`${kind}.${f}`]) {
+      const sub = { struct: `${kind}.${f}` };
+      convertFields(v, STRUCTS[`${kind}.${f}`], sub, `${kind}.${f}`);
+      out[f] = sub;
+    } else {
+      out[f] = v;
+    }
+  }
+}
+function childrenOf(n) {
+  const spec = n.kind ? KINDS[n.kind] : STRUCTS[n.struct];
+  if (!spec?.nodes) return [];
+  const out = [];
+  for (const f of spec.nodes) {
+    if (spec.notWalked?.includes(f)) continue;
+    const v = n[f];
+    if (!v) continue;
+    if (Array.isArray(v)) {
+      for (const c of v) if (c) out.push(c);
+    } else if (v.kind) {
+      out.push(v);
+    } else if (v.struct) {
+      out.push(...childrenOf(v));
+    }
+  }
+  return out;
+}
+function walk(root, fn) {
+  if (!root) return;
+  if (!fn(root)) return;
+  for (const c of childrenOf(root)) walk(c, fn);
+}
 var INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
 var INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
 var HOMOGLYPHS = {
@@ -3173,8 +3278,8 @@ var PHP = [
   ],
   ["permissions", /\b(?:chmod|chown|chgrp|lchown|lchgrp)\s*\(/]
 ];
-var { syntax } = mvdanSh;
-var sharedParser = syntax.NewParser();
+var { syntax: syntax2 } = mvdanSh2;
+var sharedParser = syntax2.NewParser();
 var SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
   "bash",
   "sh",
@@ -3187,7 +3292,7 @@ var SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
   "powershell",
   "pwsh"
 ]);
-var AST_CACHE_MAX = 5e3;
+var AST_CACHE_MAX = 256;
 var astCache = /* @__PURE__ */ new Map();
 var PARSE_FAIL = /* @__PURE__ */ Symbol("parse-fail");
 function parseShared(command) {
@@ -3199,7 +3304,7 @@ function parseShared(command) {
   }
   let parsed;
   try {
-    parsed = sharedParser.Parse(command, "cmd");
+    parsed = toPlainTree(sharedParser.Parse(command, "cmd"));
   } catch {
     parsed = PARSE_FAIL;
   }
@@ -3724,8 +3829,8 @@ var FS_OP_PRESCREEN_RE = new RegExp(
 var currentStmtOffset = Number.MAX_SAFE_INTEGER;
 function probeBinOp(src) {
   try {
-    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
-    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+    const cmd = toPlainTree(syntax2.NewParser().Parse(src, "probe"))?.Stmts?.[0]?.Cmd;
+    if (cmd && cmd.kind === "BinaryCmd") return cmd.Op;
   } catch {
   }
   return null;
@@ -3735,11 +3840,11 @@ var OR_OP = probeBinOp("a || b");
 var AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
 function deriveRedirOp(sample) {
   try {
-    const f = sharedParser.Parse(sample, "cmd");
+    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
     let op = -1;
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       const n = node;
-      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      if (n && n.kind === "Redirect" && op < 0) op = n.Op;
       return true;
     });
     return op;
@@ -3775,7 +3880,7 @@ var MCP_EXECUTORS = /* @__PURE__ */ new Set([
   "run_terminal_command",
   "start_process"
 ]);
-var { syntax: syntax2 } = mvdanSh2;
+var { syntax: syntax3 } = mvdanSh3;
 function opOf(sample) {
   return parseShared(sample).Stmts[0].Redirs[0].Op;
 }
@@ -3791,7 +3896,6 @@ var DEFAULT_OPS = new Set(
     (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
   )
 );
-var { syntax: syntax3 } = mvdanSh3;
 var SEQUENCE_OPS = (() => {
   const ops = /* @__PURE__ */ new Set();
   for (const text of ["x && y", "x || y"]) {
@@ -7033,7 +7137,6 @@ var REUSED_SIGNALS = INJECTION_SIGNALS.map(
   } : sig
 );
 var NEVER_NEGATED = /* @__PURE__ */ new Set([SIGNALS[1].any[0]]);
-var { syntax: syntax4 } = mvdanSh4;
 var RDR_IN = (() => {
   try {
     return parseShared("x <y").Stmts[0].Redirs[0].Op;
@@ -7041,8 +7144,6 @@ var RDR_IN = (() => {
     return null;
   }
 })();
-var { syntax: syntax5 } = mvdanSh5;
-var { syntax: syntax6 } = mvdanSh6;
 var SHELLS = /* @__PURE__ */ new Set([...SHELL_INTERPRETERS, "mksh", "ash", "csh", "tcsh"]);
 var NETCATS = /* @__PURE__ */ new Set(["nc", "ncat", "netcat", "nc.traditional", "nc.openbsd"]);
 var NET_CLIENTS = /* @__PURE__ */ new Set([...NETCATS, "telnet", "socat"]);
@@ -7064,7 +7165,6 @@ var SENDERS = /* @__PURE__ */ new Set([
   "invoke-restmethod",
   "openssl"
 ]);
-var { syntax: syntax7 } = mvdanSh7;
 var EDITOR_HEADS = ["code", "code-insiders", "codium", "vscodium", "cursor"];
 var MANAGER_HEADS = /* @__PURE__ */ new Set([
   "gem",
@@ -7094,7 +7194,6 @@ var MANAGER_HEADS = /* @__PURE__ */ new Set([
   "poetry",
   "pipenv"
 ]);
-var { syntax: syntax8 } = mvdanSh8;
 var TUNING_FIELDS = [
   { checkId: "network.unknown-host", name: "allow", legacy: ["egress", "allow"] },
   { checkId: "network.unknown-host", name: "deny", legacy: ["egress", "deny"] },
@@ -7252,7 +7351,6 @@ var NATIONAL_ID_LABEL_RE = new RegExp(
   ].join(""),
   "iu"
 );
-var { syntax: syntax9 } = mvdanSh9;
 var PUBLISH = {
   npm: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "registry.npmjs.org", flag: ["--registry"] },
   pnpm: { verbs: /* @__PURE__ */ new Set(["publish"]), registry: "registry.npmjs.org", flag: ["--registry"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.46.1",
+  "version": "2.47.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",