@node9/proxy 2.54.1 → 2.55.0

package/dist/index.mjs

@@ -1728,6 +1728,26 @@ function collectShellFileAccesses(command, context = {}) {
   }
   return out;
 }
+function serviceNamedIn(text) {
+  const re = new RegExp(SERVICE_WORD_RE.source, "gi");
+  for (let m = re.exec(text); m; m = re.exec(text)) {
+    const lower2 = m[1].toLowerCase();
+    if (lower2 === "init" && !INIT_PATTERN_RE.test(text)) continue;
+    return SYSTEM_SERVICES.find((s) => s.toLowerCase() === lower2) ?? m[1];
+  }
+  return null;
+}
+function serviceOf(name) {
+  const leaf = name.replace(/^.*[\\/]/, "").replace(/\.service$/, "").replace(/@.*$/, "");
+  const lower2 = leaf.toLowerCase();
+  return SYSTEM_SERVICES.find((s) => s.toLowerCase() === lower2) ?? UNIT_ALIASES[lower2] ?? null;
+}
+function killsService(language, code) {
+  const api = KILL_API[language].exec(code);
+  if (!api) return null;
+  const service = serviceNamedIn(code);
+  return service ? `${api[0].trim()} with ${service}` : null;
+}
 function inlineLanguageOf(interp) {
   const i = interp.toLowerCase();
   if (/^python[\d.]*$/.test(i)) return "python";
@@ -1802,6 +1822,15 @@ function judgeInlineCode(language, code, isProtected) {
     return { outcome: "unreadable", what: "is too long for node9 to read" };
   }
   const text = language === "python" ? resolvePythonAliases(code) : code;
+  const killed = killsService(language, text);
+  if (killed) {
+    return {
+      outcome: "dangerous",
+      what: WHAT["kills-service"],
+      evidence: killed.slice(0, 60),
+      category: "kills-service"
+    };
+  }
   for (const [category, re] of TABLES[language]) {
     const m = re.exec(text);
     if (!m) continue;
@@ -8457,6 +8486,118 @@ function scanArgumentSecrets(args) {
     severity: "review"
   } : null;
 }
+function shownOf2(words) {
+  return words.map((w) => w ?? "$?").join(" ").slice(0, 80);
+}
+function withoutComments(command) {
+  return command.split("\n").map((line) => {
+    for (let i = 0; i < line.length; i++) {
+      if (line[i] === "#" && (i === 0 || line[i - 1] === " " || line[i - 1] === "	")) {
+        return line.slice(0, i);
+      }
+    }
+    return line;
+  }).join("\n");
+}
+function detectSystemProcessStop(command, depth = 0) {
+  if (!PRESCREEN_RE3.test(command)) return null;
+  const named = serviceNamedIn(withoutComments(command));
+  let direct = null;
+  let dynamicKill = null;
+  walkCommandScope(command, (node) => {
+    const n = node;
+    if (direct || !n || n.kind !== "CallExpr") return true;
+    const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+    if (words.length === 0) return true;
+    if (baseWord(words[0]) === "xargs" && words.some((w) => w !== null && baseWord(w) === "kill")) {
+      dynamicKill ??= shownOf2(words);
+      return true;
+    }
+    if (depth < MAX_PAYLOAD_DEPTH5) {
+      const payload = literalShellPayload(words, baseWord(words[0]));
+      if (payload !== null) {
+        const inner = detectSystemProcessStop(payload, depth + 1);
+        if (inner) direct = inner;
+        return true;
+      }
+    }
+    const head = unwrapCommandHead(words);
+    if (head >= words.length) return true;
+    const name = baseWord(words[head]);
+    const rest = words.slice(head + 1);
+    const shown = shownOf2(words);
+    const viaXargs = words.slice(0, head).some((w) => w !== null && baseWord(w) === "xargs");
+    if (name === "kill") {
+      const targets = [];
+      for (let i = 0; i < rest.length; i++) {
+        const w = rest[i];
+        if (i === 0 && w !== null && KILL_SIGNAL_RE.test(w)) {
+          if (w === "-s") i++;
+          continue;
+        }
+        if (w === "--") continue;
+        targets.push(w);
+      }
+      if (targets.some((t) => t === "1" || t === "-1")) {
+        direct = { service: "init (pid 1)", how: "kills", shown };
+      } else if (viaXargs || targets.some((t) => t === null)) {
+        dynamicKill ??= shown;
+      }
+      return true;
+    }
+    if (name === "pkill" || name === "killall") {
+      let skipValue = false;
+      for (const w of rest) {
+        if (skipValue) {
+          skipValue = false;
+          continue;
+        }
+        if (w !== null && w.startsWith("-")) {
+          if (/^-(?:u|U|g|G|t|P|s|n|o|r|q|-signal|-uid|-user)$/.test(w)) skipValue = true;
+          continue;
+        }
+        if (w === null) {
+          dynamicKill ??= shown;
+          continue;
+        }
+        const service = serviceOf(w) ?? serviceNamedIn(w);
+        if (service) direct = { service, how: "kills", shown };
+      }
+      return true;
+    }
+    if (name === "systemctl") {
+      if (rest.includes("--user")) return true;
+      const verb = rest.find((w) => w !== null && !w.startsWith("-"));
+      if (verb === void 0 || verb === null || !SYSTEMCTL_STOP_VERBS.has(verb)) return true;
+      for (const w of rest.slice(rest.indexOf(verb) + 1)) {
+        const service = w === null ? null : serviceOf(w);
+        if (service) direct = { service, how: verb === "kill" ? "kills" : "stops", shown };
+      }
+      return true;
+    }
+    if (name === "service") {
+      const [unit, verb] = rest;
+      const service = typeof unit === "string" ? serviceOf(unit) : null;
+      if (service && verb === "stop") direct = { service, how: "stops", shown };
+      return true;
+    }
+    if (name === "launchctl") {
+      const verb = rest.find((w) => w !== null && !w.startsWith("-"));
+      if (verb === void 0 || verb === null || !LAUNCHCTL_UNLOAD_VERBS.has(verb)) return true;
+      const daemon = rest.find((w) => w !== null && LAUNCH_DAEMONS_RE.test(w));
+      if (daemon) {
+        direct = { service: daemon.replace(/^.*\//, ""), how: "unloads the system daemon", shown };
+      }
+      return true;
+    }
+    return true;
+  });
+  if (direct) return direct;
+  if (dynamicKill !== null && named) {
+    return { service: named, how: "kills the processes of", shown: dynamicKill };
+  }
+  return null;
+}
 function patternSelects(pattern, targets) {
   const pieces = pattern.toLowerCase().split(/[\\^$.*+?()[\]{}|]+/).filter(Boolean);
   if (pieces.length === 0) return false;
@@ -9076,6 +9217,17 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
         checkId: "commands.eval-dynamic"
       });
     }
+    const stopped = detectSystemProcessStop(shellCommand);
+    if (stopped) {
+      consider("commands.system-processes", {
+        decision: "review",
+        blockedByLabel: "Node9: System Service Stopped",
+        reason: `The AI ${stopped.how} ${stopped.service}: ${stopped.shown}`,
+        ruleDescription: "The AI stops or kills a system service (sshd, dockerd, systemd, a database or web server). Other people and programs on this machine depend on it; confirm this is intentional.",
+        tier: 3,
+        checkId: "commands.system-processes"
+      });
+    }
     const builtin = strictestVerdict(candidates);
     if (builtin) return builtin;
     {
@@ -10154,7 +10306,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, INFRASTRUCTURE_SERVICES, SERVER_SERVICES, SYSTEM_SERVICES, escape, SERVICE_WORD_RE, INIT_PATTERN_RE, UNIT_ALIASES, MAX_INLINE_CODE, WHAT, KILL_API, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, READ_CALL, ARG, WRAP, STR_PREFIX, WRITE_MODE_LITERAL, WRITE_MODE, WRITE_MODE_AFTER, PERL_WRITE_BEFORE, readCallBefore, READ_BEFORE, READ_AFTER, ASSIGNED, openedName, OPENED_NAME, DOTENV, DOTENV_PATH_OPTION, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, NODE_VALUE_FLAG, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, INLINE_INTERP_PRESCREEN_RE, runsInlineInterpreter, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, PRESCREEN_RE3, KILL_SIGNAL_RE, SYSTEMCTL_STOP_VERBS, LAUNCHCTL_UNLOAD_VERBS, LAUNCH_DAEMONS_RE, MAX_PAYLOAD_DEPTH5, RULE_NAME2, DESCRIPTION, DAEMON_CMDLINES, DAEMON_NAMES, KILLALL_NAMES, STOP_SYSTEMCTL, STOP_LAUNCHCTL, PKILL_VALUE_FLAGS, NAME_PRESCREEN_RE, base2, HOME_PID_FILE_RE, VERDICT_RANK, SQL_DML_KEYWORDS, NOT_OVERRIDABLE_CHECKS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -12029,6 +12181,11 @@ var init_dist = __esm({
         example: "/tmp/build-helper --serve",
         advice: "Keep Review. Malware often runs from /tmp."
       },
+      "commands.system-processes": {
+        plain: "The agent stops or kills a system service: sshd, dockerd, containerd, systemd, kubelet, cron, the firewall, the display server, or a database or web server (nginx, apache, mysql, postgres, redis, mongo). Directly (pkill sshd, systemctl stop docker, kill of pid 1) or through the process list (a script that finds the processes of a name and kills them). Killing a process by its number, pkill node, killall python and systemctl restart are not this check.",
+        example: "ps -eo pid,cmd | grep sshd | awk '{print $1}' | xargs kill -9",
+        advice: "Keep Review: a stopped service takes other people and programs down with it. Set Log on a machine where agents manage local servers all day."
+      },
       "commands.disk-destroy": {
         plain: "The agent formats, overwrites or securely erases a disk or file.",
         example: "dd if=/dev/zero of=/dev/sda",
@@ -12198,6 +12355,7 @@ var init_dist = __esm({
       "commands.sql-no-where": "log",
       "commands.temp-binary": "log",
       "commands.disk-destroy": "log",
+      "commands.system-processes": "log",
       "commands.dangerous-word": "log",
       "files.system-dirs": "log",
       "files.shell-startup": "log",
@@ -12516,6 +12674,16 @@ var init_dist = __esm({
         defaultValue: "review",
         legacy: ["Manual Nuclear Protection"]
       },
+      {
+        id: "commands.system-processes",
+        group: "commands",
+        owasp: "ASI02",
+        title: "Stops a system service",
+        catches: "kill, pkill, killall, systemctl stop or kill, service stop or launchctl unload aimed at a system service (sshd, dockerd, systemd, kubelet, cron, a database or web server), or a script that walks the process list for one of those names and kills what it finds",
+        values: ALL,
+        defaultValue: "review",
+        legacy: ["Node9: System Service Stopped"]
+      },
       {
         id: "commands.dangerous-word",
         group: "commands",
@@ -13175,6 +13343,82 @@ var init_dist = __esm({
         )
       )
     }));
+    INFRASTRUCTURE_SERVICES = [
+      "init",
+      "sshd",
+      "dockerd",
+      "docker-proxy",
+      "containerd",
+      "containerd-shim",
+      "docker-containerd-shim",
+      "runc",
+      "systemd-journald",
+      "journald",
+      "systemd-logind",
+      "systemd-udevd",
+      "udevd",
+      "dbus-daemon",
+      "polkitd",
+      "sssd",
+      "kubelet",
+      "kube-apiserver",
+      "crond",
+      "cron",
+      "atd",
+      "auditd",
+      "rsyslogd",
+      "syslogd",
+      "chronyd",
+      "ntpd",
+      "NetworkManager",
+      "wpa_supplicant",
+      "dhclient",
+      "avahi-daemon",
+      "firewalld",
+      "ufw",
+      "cupsd",
+      "snapd",
+      "bluetoothd",
+      "Xorg",
+      "Xwayland",
+      "gdm",
+      "sddm",
+      "lightdm"
+    ];
+    SERVER_SERVICES = [
+      "nginx",
+      "apache2",
+      "httpd",
+      "mysqld",
+      "mariadbd",
+      "postgres",
+      "postgresql",
+      "redis-server",
+      "mongod"
+    ];
+    SYSTEM_SERVICES = [...INFRASTRUCTURE_SERVICES, ...SERVER_SERVICES];
+    escape = (s) => s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+    SERVICE_WORD_RE = new RegExp(
+      `(?:^|[^A-Za-z0-9_.-])(${SYSTEM_SERVICES.map(escape).join("|")})(?![A-Za-z0-9_.-])`,
+      "i"
+    );
+    INIT_PATTERN_RE = /(?:["'*])init(?:["'*])/;
+    UNIT_ALIASES = {
+      docker: "dockerd",
+      ssh: "sshd",
+      mysql: "mysqld",
+      mariadb: "mariadbd",
+      redis: "redis-server",
+      mongodb: "mongod",
+      apache: "apache2",
+      rsyslog: "rsyslogd",
+      "systemd-networkd": "systemd-udevd",
+      dbus: "dbus-daemon",
+      avahi: "avahi-daemon",
+      bluetooth: "bluetoothd",
+      cups: "cupsd",
+      chrony: "chronyd"
+    };
     MAX_INLINE_CODE = 64 * 1024;
     WHAT = {
       deletes: "deletes files",
@@ -13186,7 +13430,15 @@ var init_dist = __esm({
       "builds-code": "runs code it builds at run time",
       permissions: "changes permissions or ownership",
       monitors: "captures the screen, the clipboard or the keyboard",
-      amplifies: "writes or sends in an endless loop"
+      amplifies: "writes or sends in an endless loop",
+      "kills-service": "stops a system service"
+    };
+    KILL_API = {
+      python: /\bos\.kill(?:pg)?\s*\(|\.(?:kill|terminate)\s*\(|\bsignal\.SIGKILL\b/,
+      node: /\bprocess\.kill\s*\(|\.kill\s*\(\s*['"`]?SIG/,
+      perl: /\bkill\s+(?:-?\d+|['"]?[A-Z]+['"]?)\s*,/,
+      ruby: /\bProcess\.kill\b/,
+      php: /\bposix_kill\s*\(/
     };
     OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
     pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
@@ -19077,6 +19329,7 @@ ${text}` : text);
       "commands.sql-no-where",
       "commands.temp-binary",
       "commands.disk-destroy",
+      "commands.system-processes",
       "commands.dangerous-word",
       "commands.node9-disarm",
       "commands.reverse-shell",
@@ -19291,6 +19544,12 @@ ${text}` : text);
       const char = value[index] ?? "";
       return RUN_CHAR.test(char) || char !== "" && isInvisibleChar(char);
     };
+    PRESCREEN_RE3 = /\b(?:kill|pkill|killall|systemctl|service|launchctl|xargs)\b/;
+    KILL_SIGNAL_RE = /^-(?:\d+|s|SIG[A-Z]+|[A-Z]{2,})$/;
+    SYSTEMCTL_STOP_VERBS = /* @__PURE__ */ new Set(["stop", "kill", "disable", "mask"]);
+    LAUNCHCTL_UNLOAD_VERBS = /* @__PURE__ */ new Set(["unload", "bootout", "remove"]);
+    LAUNCH_DAEMONS_RE = /(?:^|\/)(?:System\/)?Library\/LaunchDaemons\//;
+    MAX_PAYLOAD_DEPTH5 = 3;
     RULE_NAME2 = "review-node9-disarm";
     DESCRIPTION = "The AI wants to stop node9, remove it, or change its own files. These are your commands to run, not the agent's: with the daemon stopped the outside-content and taint checks are off.";
     DAEMON_CMDLINES = [

package/dist/scan-ink.mjs

@@ -2192,6 +2192,11 @@ var CHECK_TEXT = {
     example: "/tmp/build-helper --serve",
     advice: "Keep Review. Malware often runs from /tmp."
   },
+  "commands.system-processes": {
+    plain: "The agent stops or kills a system service: sshd, dockerd, containerd, systemd, kubelet, cron, the firewall, the display server, or a database or web server (nginx, apache, mysql, postgres, redis, mongo). Directly (pkill sshd, systemctl stop docker, kill of pid 1) or through the process list (a script that finds the processes of a name and kills them). Killing a process by its number, pkill node, killall python and systemctl restart are not this check.",
+    example: "ps -eo pid,cmd | grep sshd | awk '{print $1}' | xargs kill -9",
+    advice: "Keep Review: a stopped service takes other people and programs down with it. Set Log on a machine where agents manage local servers all day."
+  },
   "commands.disk-destroy": {
     plain: "The agent formats, overwrites or securely erases a disk or file.",
     example: "dd if=/dev/zero of=/dev/sda",
@@ -2654,6 +2659,16 @@ var PRODUCT_CHECKS = [
     defaultValue: "review",
     legacy: ["Manual Nuclear Protection"]
   },
+  {
+    id: "commands.system-processes",
+    group: "commands",
+    owasp: "ASI02",
+    title: "Stops a system service",
+    catches: "kill, pkill, killall, systemctl stop or kill, service stop or launchctl unload aimed at a system service (sshd, dockerd, systemd, kubelet, cron, a database or web server), or a script that walks the process list for one of those names and kills what it finds",
+    values: ALL,
+    defaultValue: "review",
+    legacy: ["Node9: System Service Stopped"]
+  },
   {
     id: "commands.dangerous-word",
     group: "commands",
@@ -3282,6 +3297,65 @@ var ops = lazy(() => ({
     )
   )
 }));
+var INFRASTRUCTURE_SERVICES = [
+  "init",
+  "sshd",
+  "dockerd",
+  "docker-proxy",
+  "containerd",
+  "containerd-shim",
+  "docker-containerd-shim",
+  "runc",
+  "systemd-journald",
+  "journald",
+  "systemd-logind",
+  "systemd-udevd",
+  "udevd",
+  "dbus-daemon",
+  "polkitd",
+  "sssd",
+  "kubelet",
+  "kube-apiserver",
+  "crond",
+  "cron",
+  "atd",
+  "auditd",
+  "rsyslogd",
+  "syslogd",
+  "chronyd",
+  "ntpd",
+  "NetworkManager",
+  "wpa_supplicant",
+  "dhclient",
+  "avahi-daemon",
+  "firewalld",
+  "ufw",
+  "cupsd",
+  "snapd",
+  "bluetoothd",
+  "Xorg",
+  "Xwayland",
+  "gdm",
+  "sddm",
+  "lightdm"
+];
+var SERVER_SERVICES = [
+  "nginx",
+  "apache2",
+  "httpd",
+  "mysqld",
+  "mariadbd",
+  "postgres",
+  "postgresql",
+  "redis-server",
+  "mongod"
+];
+var SYSTEM_SERVICES = [...INFRASTRUCTURE_SERVICES, ...SERVER_SERVICES];
+var escape = (s) => s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+var SERVICE_WORD_RE = new RegExp(
+  `(?:^|[^A-Za-z0-9_.-])(${SYSTEM_SERVICES.map(escape).join("|")})(?![A-Za-z0-9_.-])`,
+  "i"
+);
 var MAX_INLINE_CODE = 64 * 1024;
 var OUTSIDE = String.raw`(?:~|\.\.[\\/]|/(?!(?:tmp|var/tmp)/(?![^'"\n]*\.\.)|dev/(?:null|stdout|stderr)\b))`;
 var pyImport = (mods) => new RegExp(String.raw`\b(?:import\s+(?:[\w.]+(?:\s+as\s+\w+)?\s*,\s*)*|from\s+)(?:${mods})\b`);
@@ -7475,6 +7549,7 @@ var MAP_GOVERNED = /* @__PURE__ */ new Set([
   "commands.sql-no-where",
   "commands.temp-binary",
   "commands.disk-destroy",
+  "commands.system-processes",
   "commands.dangerous-word",
   "commands.node9-disarm",
   "commands.reverse-shell",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.54.1",
+  "version": "2.55.0",
   "description": "Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",