@node9/proxy 2.48.1 → 2.48.2

package/dist/scan-ink.mjs

@@ -238,10 +238,11 @@ import os from "os";
 
 // packages/policy-engine/dist/index.mjs
 import { fileURLToPath } from "url";
-import picomatch from "picomatch";
+import picomatch2 from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
 import { createRequire } from "module";
+import picomatch from "picomatch";
 import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 var getFilename = () => fileURLToPath(import.meta.url);
@@ -2234,6 +2235,11 @@ var CHECK_TEXT = {
     example: "Copying ~/.npmrc into /tmp",
     advice: "Fixed at Review for now."
   },
+  "data.credential-files-unknown": {
+    plain: "The agent reads files whose names a listing produces only when the command runs, so node9 cannot tell in advance whether a credential file is among them.",
+    example: "find . | xargs cat",
+    advice: "Standard records it; Strict asks. Set Review if your agents should not read files they find this way."
+  },
   "data.pipe-chain": {
     plain: "The agent reads a secret file and sends it over the network in the same command.",
     example: "An SSH key file piped into curl",
@@ -2357,6 +2363,8 @@ var STRICT = {
   "data.secrets-weak": "block",
   "data.pipe-chain": "block",
   "data.env-exfil": "block",
+  // Names a listing produces at run time: Standard records, Strict asks.
+  "data.credential-files-unknown": "review",
   "loading.unknown-registry": "block",
   "network.unknown-host": "review",
   "network.internal-addresses": "block",
@@ -2651,6 +2659,14 @@ var PRODUCT_CHECKS = [
     values: ALL,
     defaultValue: "review"
   },
+  {
+    id: "data.credential-files-unknown",
+    group: "data",
+    title: "Files read by names known only at run time",
+    catches: "a reader fed names from a listing that can include credential files (find . | xargs cat)",
+    values: ALL,
+    defaultValue: "log"
+  },
   {
     id: "data.pipe-chain",
     group: "data",
@@ -3145,6 +3161,25 @@ var SYSTEM_DIRS = [
 ];
 var UPLOAD_SYSTEM_DIRS = [...SYSTEM_DIRS, "/proc", "/sys", "/root"];
 var LEGACY_SYSTEM_PATH_RE = /^(?:[a-zA-Z]:)?\/etc\/(?:passwd|shadow|sudoers)$/;
+function opOf(sample) {
+  return parseShared(sample).Stmts[0].Redirs[0].Op;
+}
+var ops = lazy(() => ({
+  WRITES: new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf)),
+  APPENDS: new Set([">>x", "&>>x"].map(opOf)),
+  READS: new Set(["<x", "<>x"].map(opOf)),
+  /** `>&word` with a non-numeric word is `&>word` in bash. */
+  DUP_OUT: opOf(">&x"),
+  HERE_STRING: opOf("<<<x"),
+  AND: parseShared("a && b").Stmts[0].Cmd.Op,
+  OR: parseShared("a || b").Stmts[0].Cmd.Op,
+  /** `${x:-d}` `${x-d}` `${x:=d}` `${x=d}`: the default is the value when x is unset. */
+  DEFAULT_OPS: new Set(
+    ["${x:-y}", "${x-y}", "${x:=y}", "${x=y}"].map(
+      (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
+    )
+  )
+}));
 var MAX_INLINE_CODE = 64 * 1024;
 var OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
 var pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
@@ -3405,6 +3440,13 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "tac",
   "nl",
   "dd",
+  // Compare or merge files and print their lines (jail-indirect-reads,
+  // 2026-11-02): `diff .env /dev/null` printed every line of the file.
+  "diff",
+  "cmp",
+  "comm",
+  "paste",
+  "join",
   // — PowerShell, absent until 2026-09-22 —
   // Same membership test, "does it emit file contents": Get-Content/gc print
   // the file (cat), Select-String/sls print matching lines (grep), Format-Hex
@@ -3882,6 +3924,14 @@ var REDIR_FILE_IN_OPS = lazy(
 var REDIR_HEREDOC_OPS = lazy(
   () => /* @__PURE__ */ new Set([deriveRedirOp("cat <<X\nX"), deriveRedirOp("cat <<-X\nX")])
 );
+var pipeOps = lazy(
+  () => new Set(
+    ["a | b", "a |& b"].map((t) => {
+      const f = parseShared(t);
+      return typeof f === "symbol" ? -1 : f.Stmts[0].Cmd.Op;
+    })
+  )
+);
 var BASH_TOOL_NAMES = /* @__PURE__ */ new Set([
   "bash",
   "execute_bash",
@@ -3902,25 +3952,6 @@ var MCP_EXECUTORS = /* @__PURE__ */ new Set([
   "run_terminal_command",
   "start_process"
 ]);
-function opOf(sample) {
-  return parseShared(sample).Stmts[0].Redirs[0].Op;
-}
-var ops = lazy(() => ({
-  WRITES: new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf)),
-  APPENDS: new Set([">>x", "&>>x"].map(opOf)),
-  READS: new Set(["<x", "<>x"].map(opOf)),
-  /** `>&word` with a non-numeric word is `&>word` in bash. */
-  DUP_OUT: opOf(">&x"),
-  HERE_STRING: opOf("<<<x"),
-  AND: parseShared("a && b").Stmts[0].Cmd.Op,
-  OR: parseShared("a || b").Stmts[0].Cmd.Op,
-  /** `${x:-d}` `${x-d}` `${x:=d}` `${x=d}`: the default is the value when x is unset. */
-  DEFAULT_OPS: new Set(
-    ["${x:-y}", "${x-y}", "${x:=y}", "${x=y}"].map(
-      (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
-    )
-  )
-}));
 var SEQUENCE_OPS = lazy(() => {
   const ops2 = /* @__PURE__ */ new Set();
   for (const text of ["x && y", "x || y"]) {
@@ -7297,6 +7328,7 @@ var MAP_GOVERNED = /* @__PURE__ */ new Set([
   "commands.reverse-shell",
   "data.pipe-chain",
   "data.env-exfil",
+  "data.credential-files-unknown",
   "loading.unknown-registry",
   // The general action checks (node9Firewall#390): smart rules the map governs.
   "actions.money",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.48.1",
+  "version": "2.48.2",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",