@node9/proxy 2.54.1 → 2.55.0

package/dist/index.js

@@ -1741,6 +1741,26 @@ function collectShellFileAccesses(command, context = {}) {
   }
   return out;
 }
+function serviceNamedIn(text) {
+  const re = new RegExp(SERVICE_WORD_RE.source, "gi");
+  for (let m = re.exec(text); m; m = re.exec(text)) {
+    const lower2 = m[1].toLowerCase();
+    if (lower2 === "init" && !INIT_PATTERN_RE.test(text)) continue;
+    return SYSTEM_SERVICES.find((s) => s.toLowerCase() === lower2) ?? m[1];
+  }
+  return null;
+}
+function serviceOf(name) {
+  const leaf = name.replace(/^.*[\\/]/, "").replace(/\.service$/, "").replace(/@.*$/, "");
+  const lower2 = leaf.toLowerCase();
+  return SYSTEM_SERVICES.find((s) => s.toLowerCase() === lower2) ?? UNIT_ALIASES[lower2] ?? null;
+}
+function killsService(language, code) {
+  const api = KILL_API[language].exec(code);
+  if (!api) return null;
+  const service = serviceNamedIn(code);
+  return service ? `${api[0].trim()} with ${service}` : null;
+}
 function inlineLanguageOf(interp) {
   const i = interp.toLowerCase();
   if (/^python[\d.]*$/.test(i)) return "python";
@@ -1815,6 +1835,15 @@ function judgeInlineCode(language, code, isProtected) {
     return { outcome: "unreadable", what: "is too long for node9 to read" };
   }
   const text = language === "python" ? resolvePythonAliases(code) : code;
+  const killed = killsService(language, text);
+  if (killed) {
+    return {
+      outcome: "dangerous",
+      what: WHAT["kills-service"],
+      evidence: killed.slice(0, 60),
+      category: "kills-service"
+    };
+  }
   for (const [category, re] of TABLES[language]) {
     const m = re.exec(text);
     if (!m) continue;
@@ -8470,6 +8499,118 @@ function scanArgumentSecrets(args) {
     severity: "review"
   } : null;
 }
+function shownOf2(words) {
+  return words.map((w) => w ?? "$?").join(" ").slice(0, 80);
+}
+function withoutComments(command) {
+  return command.split("\n").map((line) => {
+    for (let i = 0; i < line.length; i++) {
+      if (line[i] === "#" && (i === 0 || line[i - 1] === " " || line[i - 1] === "	")) {
+        return line.slice(0, i);
+      }
+    }
+    return line;
+  }).join("\n");
+}
+function detectSystemProcessStop(command, depth = 0) {
+  if (!PRESCREEN_RE3.test(command)) return null;
+  const named = serviceNamedIn(withoutComments(command));
+  let direct = null;
+  let dynamicKill = null;
+  walkCommandScope(command, (node) => {
+    const n = node;
+    if (direct || !n || n.kind !== "CallExpr") return true;
+    const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+    if (words.length === 0) return true;
+    if (baseWord(words[0]) === "xargs" && words.some((w) => w !== null && baseWord(w) === "kill")) {
+      dynamicKill ??= shownOf2(words);
+      return true;
+    }
+    if (depth < MAX_PAYLOAD_DEPTH5) {
+      const payload = literalShellPayload(words, baseWord(words[0]));
+      if (payload !== null) {
+        const inner = detectSystemProcessStop(payload, depth + 1);
+        if (inner) direct = inner;
+        return true;
+      }
+    }
+    const head = unwrapCommandHead(words);
+    if (head >= words.length) return true;
+    const name = baseWord(words[head]);
+    const rest = words.slice(head + 1);
+    const shown = shownOf2(words);
+    const viaXargs = words.slice(0, head).some((w) => w !== null && baseWord(w) === "xargs");
+    if (name === "kill") {
+      const targets = [];
+      for (let i = 0; i < rest.length; i++) {
+        const w = rest[i];
+        if (i === 0 && w !== null && KILL_SIGNAL_RE.test(w)) {
+          if (w === "-s") i++;
+          continue;
+        }
+        if (w === "--") continue;
+        targets.push(w);
+      }
+      if (targets.some((t) => t === "1" || t === "-1")) {
+        direct = { service: "init (pid 1)", how: "kills", shown };
+      } else if (viaXargs || targets.some((t) => t === null)) {
+        dynamicKill ??= shown;
+      }
+      return true;
+    }
+    if (name === "pkill" || name === "killall") {
+      let skipValue = false;
+      for (const w of rest) {
+        if (skipValue) {
+          skipValue = false;
+          continue;
+        }
+        if (w !== null && w.startsWith("-")) {
+          if (/^-(?:u|U|g|G|t|P|s|n|o|r|q|-signal|-uid|-user)$/.test(w)) skipValue = true;
+          continue;
+        }
+        if (w === null) {
+          dynamicKill ??= shown;
+          continue;
+        }
+        const service = serviceOf(w) ?? serviceNamedIn(w);
+        if (service) direct = { service, how: "kills", shown };
+      }
+      return true;
+    }
+    if (name === "systemctl") {
+      if (rest.includes("--user")) return true;
+      const verb = rest.find((w) => w !== null && !w.startsWith("-"));
+      if (verb === void 0 || verb === null || !SYSTEMCTL_STOP_VERBS.has(verb)) return true;
+      for (const w of rest.slice(rest.indexOf(verb) + 1)) {
+        const service = w === null ? null : serviceOf(w);
+        if (service) direct = { service, how: verb === "kill" ? "kills" : "stops", shown };
+      }
+      return true;
+    }
+    if (name === "service") {
+      const [unit, verb] = rest;
+      const service = typeof unit === "string" ? serviceOf(unit) : null;
+      if (service && verb === "stop") direct = { service, how: "stops", shown };
+      return true;
+    }
+    if (name === "launchctl") {
+      const verb = rest.find((w) => w !== null && !w.startsWith("-"));
+      if (verb === void 0 || verb === null || !LAUNCHCTL_UNLOAD_VERBS.has(verb)) return true;
+      const daemon = rest.find((w) => w !== null && LAUNCH_DAEMONS_RE.test(w));
+      if (daemon) {
+        direct = { service: daemon.replace(/^.*\//, ""), how: "unloads the system daemon", shown };
+      }
+      return true;
+    }
+    return true;
+  });
+  if (direct) return direct;
+  if (dynamicKill !== null && named) {
+    return { service: named, how: "kills the processes of", shown: dynamicKill };
+  }
+  return null;
+}
 function patternSelects(pattern, targets) {
   const pieces = pattern.toLowerCase().split(/[\\^$.*+?()[\]{}|]+/).filter(Boolean);
   if (pieces.length === 0) return false;
@@ -9089,6 +9230,17 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         checkId: "commands.eval-dynamic"
       });
     }
+    const stopped = detectSystemProcessStop(shellCommand);
+    if (stopped) {
+      consider("commands.system-processes", {
+        decision: "review",
+        blockedByLabel: "Node9: System Service Stopped",
+        reason: `The AI ${stopped.how} ${stopped.service}: ${stopped.shown}`,
+        ruleDescription: "The AI stops or kills a system service (sshd, dockerd, systemd, a database or web server). Other people and programs on this machine depend on it; confirm this is intentional.",
+        tier: 3,
+        checkId: "commands.system-processes"
+      });
+    }
     const builtin = strictestVerdict(candidates);
     if (builtin) return builtin;
     {
@@ -10167,7 +10319,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, INFRASTRUCTURE_SERVICES, SERVER_SERVICES, SYSTEM_SERVICES, escape, SERVICE_WORD_RE, INIT_PATTERN_RE, UNIT_ALIASES, MAX_INLINE_CODE, WHAT, KILL_API, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, PRESCREEN_RE3, KILL_SIGNAL_RE, SYSTEMCTL_STOP_VERBS, LAUNCHCTL_UNLOAD_VERBS, LAUNCH_DAEMONS_RE, MAX_PAYLOAD_DEPTH5, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -12053,6 +12205,11 @@ var init_dist = __esm({
         example: "/tmp/build-helper --serve",
         advice: "Keep Review. Malware often runs from /tmp."
       },
+      "commands.system-processes": {
+        plain: "The agent stops or kills a system service: sshd, dockerd, containerd, systemd, kubelet, cron, the firewall, the display server, or a database or web server (nginx, apache, mysql, postgres, redis, mongo). Directly (pkill sshd, systemctl stop docker, kill of pid 1) or through the process list (a script that finds the processes of a name and kills them). Killing a process by its number, pkill node, killall python and systemctl restart are not this check.",
+        example: "ps -eo pid,cmd | grep sshd | awk '{print $1}' | xargs kill -9",
+        advice: "Keep Review: a stopped service takes other people and programs down with it. Set Log on a machine where agents manage local servers all day."
+      },
       "commands.disk-destroy": {
         plain: "The agent formats, overwrites or securely erases a disk or file.",
         example: "dd if=/dev/zero of=/dev/sda",
@@ -12222,6 +12379,7 @@ var init_dist = __esm({
       "commands.sql-no-where": "log",
       "commands.temp-binary": "log",
       "commands.disk-destroy": "log",
+      "commands.system-processes": "log",
       "commands.dangerous-word": "log",
       "files.system-dirs": "log",
       "files.shell-startup": "log",
@@ -12540,6 +12698,16 @@ var init_dist = __esm({
         defaultValue: "review",
         legacy: ["Manual Nuclear Protection"]
       },
+      {
+        id: "commands.system-processes",
+        group: "commands",
+        owasp: "ASI02",
+        title: "Stops a system service",
+        catches: "kill, pkill, killall, systemctl stop or kill, service stop or launchctl unload aimed at a system service (sshd, dockerd, systemd, kubelet, cron, a database or web server), or a script that walks the process list for one of those names and kills what it finds",
+        values: ALL,
+        defaultValue: "review",
+        legacy: ["Node9: System Service Stopped"]
+      },
       {
         id: "commands.dangerous-word",
         group: "commands",
@@ -13199,6 +13367,82 @@ var init_dist = __esm({
         )
       )
     }));
+    INFRASTRUCTURE_SERVICES = [
+      "init",
+      "sshd",
+      "dockerd",
+      "docker-proxy",
+      "containerd",
+      "containerd-shim",
+      "docker-containerd-shim",
+      "runc",
+      "systemd-journald",
+      "journald",
+      "systemd-logind",
+      "systemd-udevd",
+      "udevd",
+      "dbus-daemon",
+      "polkitd",
+      "sssd",
+      "kubelet",
+      "kube-apiserver",
+      "crond",
+      "cron",
+      "atd",
+      "auditd",
+      "rsyslogd",
+      "syslogd",
+      "chronyd",
+      "ntpd",
+      "NetworkManager",
+      "wpa_supplicant",
+      "dhclient",
+      "avahi-daemon",
+      "firewalld",
+      "ufw",
+      "cupsd",
+      "snapd",
+      "bluetoothd",
+      "Xorg",
+      "Xwayland",
+      "gdm",
+      "sddm",
+      "lightdm"
+    ];
+    SERVER_SERVICES = [
+      "nginx",
+      "apache2",
+      "httpd",
+      "mysqld",
+      "mariadbd",
+      "postgres",
+      "postgresql",
+      "redis-server",
+      "mongod"
+    ];
+    SYSTEM_SERVICES = [...INFRASTRUCTURE_SERVICES, ...SERVER_SERVICES];
+    escape = (s) => s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+    SERVICE_WORD_RE = new RegExp(
+      `(?:^|[^A-Za-z0-9_.-])(${SYSTEM_SERVICES.map(escape).join("|")})(?![A-Za-z0-9_.-])`,
+      "i"
+    );
+    INIT_PATTERN_RE = /(?:["'*])init(?:["'*])/;
+    UNIT_ALIASES = {
+      docker: "dockerd",
+      ssh: "sshd",
+      mysql: "mysqld",
+      mariadb: "mariadbd",
+      redis: "redis-server",
+      mongodb: "mongod",
+      apache: "apache2",
+      rsyslog: "rsyslogd",
+      "systemd-networkd": "systemd-udevd",
+      dbus: "dbus-daemon",
+      avahi: "avahi-daemon",
+      bluetooth: "bluetoothd",
+      cups: "cupsd",
+      chrony: "chronyd"
+    };
     MAX_INLINE_CODE = 64 * 1024;
     WHAT = {
       deletes: "deletes files",
@@ -13210,7 +13454,15 @@ var init_dist = __esm({
       "builds-code": "runs code it builds at run time",
       permissions: "changes permissions or ownership",
       monitors: "captures the screen, the clipboard or the keyboard",
-      amplifies: "writes or sends in an endless loop"
+      amplifies: "writes or sends in an endless loop",
+      "kills-service": "stops a system service"
+    };
+    KILL_API = {
+      python: /\bos\.kill(?:pg)?\s*\(|\.(?:kill|terminate)\s*\(|\bsignal\.SIGKILL\b/,
+      node: /\bprocess\.kill\s*\(|\.kill\s*\(\s*['"`]?SIG/,
+      perl: /\bkill\s+(?:-?\d+|['"]?[A-Z]+['"]?)\s*,/,
+      ruby: /\bProcess\.kill\b/,
+      php: /\bposix_kill\s*\(/
     };
     OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
     pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
@@ -19101,6 +19353,7 @@ ${text}` : text);
       "commands.sql-no-where",
       "commands.temp-binary",
       "commands.disk-destroy",
+      "commands.system-processes",
       "commands.dangerous-word",
       "commands.node9-disarm",
       "commands.reverse-shell",
@@ -19315,6 +19568,12 @@ ${text}` : text);
       const char = value[index] ?? "";
       return RUN_CHAR.test(char) || char !== "" && isInvisibleChar(char);
     };
+    PRESCREEN_RE3 = /\b(?:kill|pkill|killall|systemctl|service|launchctl|xargs)\b/;
+    KILL_SIGNAL_RE = /^-(?:\d+|s|SIG[A-Z]+|[A-Z]{2,})$/;
+    SYSTEMCTL_STOP_VERBS = /* @__PURE__ */ new Set(["stop", "kill", "disable", "mask"]);
+    LAUNCHCTL_UNLOAD_VERBS = /* @__PURE__ */ new Set(["unload", "bootout", "remove"]);
+    LAUNCH_DAEMONS_RE = /(?:^|\/)(?:System\/)?Library\/LaunchDaemons\//;
+    MAX_PAYLOAD_DEPTH5 = 3;
     RULE_NAME2 = "review-node9-disarm";
     DESCRIPTION = "The AI wants to stop node9, remove it, or change its own files. These are your commands to run, not the agent's: with the daemon stopped the outside-content and taint checks are off.";
     DAEMON_CMDLINES = [