@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/src/core/agents/offSecAgent/tools/destructiveGuard.ts

@@ -0,0 +1,747 @@
+/**
+ * Destructive-action guard — deterministic, latency-free classification of
+ * tool calls that would perform irreversible / high-blast-radius operations
+ * against a target (or the host), plus fail-closed enforcement.
+ *
+ * Motivation: a pentest routinely needs to send writes (POST/PUT/PATCH) to
+ * prove authorization/IDOR flaws, so blocking *all* writes would neuter the
+ * agent. What clients want gated behind an explicit opt-in is the destructive
+ * subset — DB deletes/drops/truncates, API write-deletes, and catastrophic
+ * host operations. This module classifies exactly that subset.
+ *
+ * Design: a layered pipeline of pure predicates (regex + structural rules).
+ * NO LLM, NO network, NO I/O — classification is O(input length) so it adds
+ * effectively zero latency on the tool-call hot path. Each rule is named so a
+ * block reason is specific and debuggable.
+ *
+ * Two false-signal traps this deliberately avoids:
+ *  - Over-blocking benign recon: a destructive keyword merely *mentioned* in a
+ *    URL/path, a doc, a grepped log, or prose is NOT destructive. SQL/NoSQL in
+ *    a command is only destructive when an actual DB client executes it; in an
+ *    HTTP request only when it appears as a real statement/injection payload.
+ *  - Under-blocking real ops: encoded payloads are decoded first, and method /
+ *    delete-verb / override detection covers the common obfuscations.
+ *
+ * Enforcement mirrors {@link scopeGuard}: the assert helpers are a no-op when
+ * destructive testing is authorized (`session.config.allowDestructiveActions
+ * === true`) and otherwise throw {@link DestructiveActionError}, which the
+ * `http_request` / `execute_command` tools translate into a structured, non-
+ * fatal error result the model can read and route around.
+ */
+
+import type { ToolContext } from "./types";
+
+/** Destructive category, used for the block reason + observability. */
+export type DestructiveCategory =
+  | "http-delete-method"
+  | "http-destructive-path"
+  | "financial-side-effect"
+  | "sql-destructive"
+  | "nosql-destructive"
+  | "host-destructive";
+
+export type DestructiveClassification =
+  | {
+      destructive: false;
+      category?: never;
+      ruleId?: never;
+      reason?: never;
+    }
+  | {
+      destructive: true;
+      category: DestructiveCategory;
+      /** Stable rule id that fired (for logs / block message). */
+      ruleId: string;
+      /** Human-readable explanation of what was matched. */
+      reason: string;
+    };
+
+const NOT_DESTRUCTIVE: DestructiveClassification = { destructive: false };
+
+// ---------------------------------------------------------------------------
+// Decoding
+// ---------------------------------------------------------------------------
+
+/**
+ * Best-effort URL/form decode so percent- or `+`-encoded payloads are matched
+ * the same as their plaintext form (`%2Fdelete` → `/delete`, `DROP%20TABLE` →
+ * `DROP TABLE`). Runs up to two passes to unwrap double-encoding, decodes each
+ * `%XX` sequence independently so a stray `%` never throws.
+ */
+function safeDecode(input: string): string {
+  let out = input ?? "";
+  for (let pass = 0; pass < 2; pass++) {
+    const decoded = out.replace(/\+/g, " ").replace(/%[0-9a-fA-F]{2}/g, (m) => {
+      try {
+        return decodeURIComponent(m);
+      } catch {
+        return m;
+      }
+    });
+    if (decoded === out) break;
+    out = decoded;
+  }
+  return out;
+}
+
+function stripUrlAuthorities(input: string): string {
+  return input.replace(/\bhttps?:\/\/[^/\s"'`;|&)<>]+/gi, "");
+}
+
+// ---------------------------------------------------------------------------
+// SQL / NoSQL statement patterns
+// ---------------------------------------------------------------------------
+
+/**
+ * Inter-keyword separator: whitespace or an inline SQL block comment, so
+ * comment-obfuscated forms like `DROP/**​/TABLE` or `DELETE/**​/FROM` still
+ * match (a common SQLi bypass).
+ */
+const SQL_SEP = String.raw`(?:\s|/\*[\s\S]*?\*/)+`;
+
+/**
+ * Destructive SQL DML/DDL statement head: DROP {TABLE,DATABASE,...}, TRUNCATE,
+ * DELETE FROM, ALTER TABLE ... DROP. Deliberately does NOT match
+ * INSERT/UPDATE/SELECT — ordinary writes stay allowed.
+ */
+const SQL_DESTRUCTIVE_STATEMENT = new RegExp(
+  `(?:drop${SQL_SEP}(?:table|database|schema|index|view|column|role|user|sequence|trigger|function|procedure)` +
+    `|truncate${SQL_SEP}(?:table${SQL_SEP})?[\`"\\w]` +
+    `|delete${SQL_SEP}from${SQL_SEP}[\`"\\w]` +
+    `|alter${SQL_SEP}table${SQL_SEP}[^;]*\\bdrop\\b)`,
+  "i",
+);
+
+/** The statement is the (trimmed) start of the payload — a raw-SQL body. */
+const SQL_STATEMENT_START = new RegExp(
+  `^\\s*['"\`;)\\s]*(?:${SQL_DESTRUCTIVE_STATEMENT.source})`,
+  "i",
+);
+
+/** Classic SQLi break: a quote (and/or `;`) immediately preceding the statement. */
+const SQL_INJECTION_CONTEXT = new RegExp(
+  `['"\`]\\s*;?\\s*(?:${SQL_DESTRUCTIVE_STATEMENT.source})|;\\s*(?:${SQL_DESTRUCTIVE_STATEMENT.source})`,
+  "i",
+);
+
+/**
+ * Destructive SQL carried in an HTTP request. Requires the statement to look
+ * like an actual statement or injection payload — a raw statement at the start,
+ * or a statement right after a SQLi break (`'`, `"`, `;`) — so prose or JSON
+ * that merely mentions "delete from" / "drop table" is not flagged.
+ */
+function httpCarriesDestructiveSql(decoded: string): boolean {
+  if (!SQL_DESTRUCTIVE_STATEMENT.test(decoded)) return false;
+  return (
+    SQL_STATEMENT_START.test(decoded) || SQL_INJECTION_CONTEXT.test(decoded)
+  );
+}
+
+/**
+ * Destructive NoSQL / cache operation in an HTTP body. Structured call forms
+ * (`db.x.drop()`, `dropDatabase(`, `deleteMany(`) or a Redis flush issued as a
+ * command line (start-of-body / after `;`/newline) — not a bare word buried in
+ * a path or prose.
+ */
+const NOSQL_HTTP_DESTRUCTIVE =
+  /\bdb(?:\.\w+)+\.(?:drop(?:Database)?|deleteMany|remove)\s*\(|\.dropDatabase\s*\(|\.drop\s*\(\s*\)|\bdeleteMany\s*\(\s*\{|(?:^|[\n;])\s*(?:flushall|flushdb)\b/i;
+
+/** Destructive NoSQL / cache op in a shell command (paired with a DB client). */
+const NOSQL_CMD_DESTRUCTIVE =
+  /\bdb(?:\.\w+)*\.(?:drop(?:Database)?|deleteMany|remove)\s*\(|\.dropDatabase\s*\(|\.drop\s*\(\s*\)|\bflushall\b|\bflushdb\b/i;
+
+// ---------------------------------------------------------------------------
+// HTTP method / path / override
+// ---------------------------------------------------------------------------
+
+/** Write methods that become destructive when aimed at a delete/destroy route. */
+const WRITE_METHODS = new Set(["POST", "PUT", "PATCH"]);
+
+/**
+ * Path/query segments that signal an intent to delete or wipe. Word-bounded so
+ * `/deleted-items` (a listing) does not match while `/users/1/delete` does.
+ * Run against the DECODED url.
+ */
+const DESTRUCTIVE_PATH_PATTERN =
+  /(?:^|[/_?&=.-])(?:delete|destroy|drop|purge|truncate|wipe|obliterate|nuke|remove|hard[-_]?delete|force[-_]?delete)(?:[/_?&=.-]|$)/i;
+
+const FINANCIAL_RESOURCE = String.raw`(?:payout(?:s|[-_.\s]?(?:links?|requests?))?|payment(?:s|[-_.\s]?intents?)?|transfers?|withdraw(?:als?)?|refunds?|charges?|disbursements?|remittances?)`;
+const FINANCIAL_ACTION =
+  "(?:create|send|issue|initiate|approve|submit|process|execute)";
+
+const FINANCIAL_PATH_PATTERN = new RegExp(
+  String.raw`(?:^|[/_?&=.'"\x60\s([{:-])${FINANCIAL_RESOURCE}(?:[/_?&=.'"\x60\s)\]}:-]|$)`,
+  "i",
+);
+
+/**
+ * Financial mutations can also hide behind generic webhook / GraphQL routes.
+ * Require an explicit action or provider event token instead of matching bare
+ * words such as "amount" so ordinary form submissions stay available.
+ */
+const FINANCIAL_BODY_PATTERN = new RegExp(
+  String.raw`\bPAYMENT[._-]PAYOUTS?(?:[._-]ITEM)?\b|${FINANCIAL_ACTION}[-_.\s]*${FINANCIAL_RESOURCE}\b|${FINANCIAL_RESOURCE}[-_.\s]*${FINANCIAL_ACTION}\b`,
+  "i",
+);
+
+/**
+ * Method-override to DELETE via header, query, or body — covers the common
+ * override header spellings (`X-HTTP-Method-Override`, `X-HTTP-Method`,
+ * `X-Method-Override`, `X-Method`) plus `_method` / `httpMethod` params.
+ */
+const METHOD_OVERRIDE_DELETE_PATTERN =
+  /(?:_method|x-http-method-override|x-http-method|x-method-override|x-method|httpmethod)\s*[=:]\s*['"]?delete\b/i;
+
+// ---------------------------------------------------------------------------
+// Host-destructive command rules (anchored to command position, not substring)
+// ---------------------------------------------------------------------------
+
+/**
+ * Start of a command word: line start, after a shell separator or subshell
+ * `(`, or immediately inside a shell wrapper's quoted `-c "…"` argument (so
+ * `bash -c "dd …"` / `sh -lc 'mkfs …'` are not hidden from the host rules).
+ */
+const CMD_BOUNDARY = String.raw`(?:^|[\n;&|(]|&&|\|\||-[a-z]*c\s+["']?)\s*(?:sudo\s+)?`;
+
+/** Home-directory reference: `~`, `~user`, `$HOME`, `${HOME}`. */
+const HOME_REF = /^(?:~[^/]*|\$\{?HOME\}?)(?:\/|$)/;
+
+/**
+ * Normalize an `rm` target so path tricks resolve to their real destination:
+ * strip quotes, collapse `//` and `.`/`..` segments. Home refs collapse to
+ * `~`. Returns the normalized absolute/relative path (or `~`).
+ */
+function normalizeRmTarget(raw: string): string {
+  const unquoted = raw.replace(/^['"]|['"]$/g, "");
+  if (HOME_REF.test(unquoted)) return "~";
+  if (!unquoted.startsWith("/")) return unquoted;
+  const stack: string[] = [];
+  for (const seg of unquoted.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      stack.pop();
+      continue;
+    }
+    stack.push(seg);
+  }
+  return `/${stack.join("/")}`;
+}
+
+/**
+ * `rm` with BOTH recursive and force semantics (flags in any order, combined or
+ * split) aimed at a filesystem root, home, or system dir — or with
+ * `--no-preserve-root`. Path tricks (`/tmp/../`, `//`, `/.`) are normalized
+ * first. Ordinary sandbox scratch cleanup (`rm -rf /tmp/x`, `rm -rf ./build`)
+ * does NOT match.
+ */
+function isDangerousRm(command: string): boolean {
+  const rmRe = /\brm\b([^\n;|&]*)/gi;
+  for (const match of command.matchAll(rmRe)) {
+    const args = match[1] ?? "";
+    const hasRecursive = /(?:^|\s)(?:-[a-z]*r[a-z]*|--recursive)\b/i.test(args);
+    const hasForce = /(?:^|\s)(?:-[a-z]*f[a-z]*|--force)\b/i.test(args);
+    if (!hasRecursive || !hasForce) continue;
+    if (/--no-preserve-root/i.test(args)) return true;
+    for (const rawToken of args.split(/\s+/)) {
+      if (!rawToken || rawToken.startsWith("-")) continue;
+      // Wildcard root (`/*`) — a full-filesystem glob.
+      if (/^['"]?\/\*/.test(rawToken)) return true;
+      const norm = normalizeRmTarget(rawToken);
+      if (norm === "~") return true; // home directory wipe
+      if (norm === "/") return true; // filesystem root
+      // A system or home directory, with or without a subpath.
+      if (
+        /^\/(?:etc|var|usr|bin|sbin|boot|lib|lib64|root|home|opt|srv|sys|proc|dev)(?:\/|$)/i.test(
+          norm,
+        )
+      ) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+const HOST_DESTRUCTIVE_RULES: Array<{
+  id: string;
+  test: (command: string) => boolean;
+}> = [
+  { id: "rm-rf-root", test: isDangerousRm },
+  // Raw block-device write / disk imaging — excluding safe pseudo-devices
+  // (`/dev/null`, `/dev/stdout`, …) that ordinary commands write to.
+  {
+    id: "dd-to-device",
+    test: (c) => {
+      const m = new RegExp(
+        `${CMD_BOUNDARY}dd\\b[^\\n;|&]*\\bof=\\s*['"]?(/dev/\\S+)`,
+        "i",
+      ).exec(c);
+      if (!m) return false;
+      const dev = m[1].replace(/['"].*$/, "");
+      return !/^\/dev\/(?:null|zero|full|random|urandom|stdout|stderr|tty|fd\/)/i.test(
+        dev,
+      );
+    },
+  },
+  // Filesystem creation over a device.
+  {
+    id: "mkfs",
+    test: (c) =>
+      new RegExp(`${CMD_BOUNDARY}(?:/s?bin/)?mkfs(?:\\.\\w+)?\\b`, "i").test(c),
+  },
+  // Redirect into a block device (physical or virtual/cloud root disks).
+  {
+    id: "clobber-device",
+    test: (c) =>
+      />\s*['"]?\/dev\/(?:sd|nvme|hd|vd|xvd|mapper|disk|loop|dm-|md)/i.test(c),
+  },
+  // Classic fork bomb.
+  {
+    id: "fork-bomb",
+    test: (c) => /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(c),
+  },
+  // Power-state changes — only as an executed command, not a URL/path token.
+  {
+    id: "power-state",
+    test: (c) =>
+      new RegExp(
+        `${CMD_BOUNDARY}(?:/(?:usr/)?s?bin/)?(?:shutdown|reboot|halt|poweroff)\\b`,
+        "i",
+      ).test(c) || new RegExp(`${CMD_BOUNDARY}init\\s+0\\b`, "i").test(c),
+  },
+];
+
+// ---------------------------------------------------------------------------
+// HTTP-in-command detection
+// ---------------------------------------------------------------------------
+
+const HTTP_CLIENT_PATTERN = /\b(?:curl|wget|xh|httpie)\b/i;
+const URL_IN_COMMAND = /https?:\/\/[^\s"'`;|&)<>]+/gi;
+
+/** `-X DELETE`, `-XDELETE`, `--request=DELETE`, `--method delete`. */
+const CURL_DELETE = /(?:-X|--request|--method)[=\s]*['"]?delete\b/i;
+
+/** httpie/xh positional method: `http DELETE url`, `xh delete url` (at cmd pos). */
+const HTTPIE_METHOD = new RegExp(
+  `${CMD_BOUNDARY}(?:https?|xh|httpie)\\s+(?:-{1,2}\\S+\\s+)*(delete|post|put|patch)\\b`,
+  "i",
+);
+const CURL_WRITE_METHOD =
+  /(?:-X|--request|--method)[=\s]*['"]?(?:post|put|patch)\b/i;
+// Body/data flags across curl (-d/--data*/-F/--form/--json) and wget
+// (--post-data/--post-file/--body-data/--body-file) that indicate a write.
+const CURL_DATA_FLAG =
+  /(?:^|\s)(?:-d|--data(?:-raw|-binary|-urlencode|-ascii)?|-F|--form|--json|--post-data|--post-file|--body-data|--body-file)\b/i;
+
+/**
+ * In-script HTTP DELETE nested inside `execute_command` (Node/Bun/Deno,
+ * Playwright, ts-node, etc.) — the path apex's http_request-level controls and
+ * the curl-based detection above both miss. The reliable signal is a DELETE
+ * method on an HTTP call, NOT the URL: the dangerous path is frequently built
+ * dynamically (`fetch(`/api/x/${id}`, …)` where `id` resolves to `undefined`),
+ * so it never contains a literal delete keyword.
+ *
+ * Two forms:
+ *  - a request-options object carrying `method: 'DELETE'` (fetch / axios config
+ *    / Playwright request options), paired with an HTTP-client token so a grep
+ *    for the literal string is not misclassified; and
+ *  - a positional client delete call (`axios.delete(`, `page.request.delete(`).
+ */
+const JS_METHOD_DELETE = /\bmethod\s*['"`]?\s*:\s*['"`]?\s*delete\b/i;
+const SCRIPT_METHOD_WRITE =
+  /\bmethod\s*['"`]?\s*:\s*['"`]?\s*(?:post|put|patch)\b/i;
+const SCRIPT_HTTP_CLIENT_HINT =
+  /\b(?:fetch|axios|got|ky|superagent|needle|node-fetch|undici|phin|XMLHttpRequest|xhr|requests|httpx|urllib3|page|apiContext|apiRequestContext|request)\b\s*(?:\.\s*\w+\s*)*\(/i;
+const JS_CLIENT_DELETE_CALL =
+  /\b(?:axios|got|ky|superagent|needle|supertest|phin|page|apiContext|apiRequestContext|request)\s*(?:\.\s*\w+)*\.\s*delete\s*\(/i;
+const SCRIPT_CLIENT_WRITE_CALL = /\.(?:post|put|patch)\s*\(/i;
+const SCRIPT_POSITIONAL_WRITE_CALL =
+  /\.request\s*\(\s*['"`](?:post|put|patch)['"`]/i;
+const SHELL_DATA_ARGUMENT =
+  /(?:^|\s)(?:-d|--data(?:-raw|-binary|-urlencode|-ascii)?|-F|--form|--json|--post-data|--body-data)(?:=|\s)+(?:'([^']*)'|"([^"]*)"|(\S+))/gi;
+const SHELL_VARIABLE_TARGET = /\$\{?[A-Za-z_]\w*\}?\/[^\s"'`;|&)<>]+/g;
+const SHELL_VARIABLE_ASSIGNMENT =
+  /\b([A-Za-z_]\w*)\s*=\s*(?:'([^']*)'|"([^"]*)")/g;
+const QUOTED_SCRIPT_VALUE = /(['"`])((?:\\.|(?!\1)[\s\S])*?)\1/g;
+
+function extractShellRequestContent(command: string): string {
+  const fragments = [
+    ...(command.match(URL_IN_COMMAND) ?? []),
+    ...(command.match(SHELL_VARIABLE_TARGET) ?? []),
+  ];
+  for (const match of command.matchAll(SHELL_DATA_ARGUMENT)) {
+    fragments.push(match[1] ?? match[2] ?? match[3] ?? "");
+  }
+  for (const match of command.matchAll(SHELL_VARIABLE_ASSIGNMENT)) {
+    const name = match[1];
+    const value = match[2] ?? match[3] ?? "";
+    if (
+      name &&
+      new RegExp(String.raw`\$\{?${name}\}?`).test(
+        command.slice((match.index ?? 0) + match[0].length),
+      )
+    ) {
+      fragments.push(value);
+    }
+  }
+  return fragments.join("\n");
+}
+
+function extractScriptRequestContent(command: string): string {
+  const fragments: string[] = command.match(URL_IN_COMMAND) ?? [];
+  for (const match of command.matchAll(QUOTED_SCRIPT_VALUE)) {
+    const value = match[2] ?? "";
+    if (
+      /^(?:https?:\/\/|\/|\$\{?[\w]+}?\/)/i.test(value) ||
+      FINANCIAL_BODY_PATTERN.test(value)
+    ) {
+      fragments.push(value);
+    }
+  }
+  return fragments.join("\n");
+}
+
+/** Classify an HTTP call expressed as a shell command (curl/wget/httpie/xh, or an in-script fetch/axios). */
+function classifyCommandHttp(command: string): DestructiveClassification {
+  const decoded = safeDecode(command);
+  const httpieMethod = HTTPIE_METHOD.exec(command)?.[1]?.toLowerCase();
+  // A real HTTP context — a shell client (curl/wget/xh/httpie) or an in-script
+  // JS client. DELETE / override / SQL detection is gated on this so a benign
+  // recon `grep -X DELETE` / `echo _method=DELETE` is not misclassified.
+  const hasShellHttpClient =
+    HTTP_CLIENT_PATTERN.test(command) || httpieMethod !== undefined;
+  const hasScriptHttpClient = SCRIPT_HTTP_CLIENT_HINT.test(command);
+  const shellRequestContent = extractShellRequestContent(decoded);
+  const scriptRequestContent = extractScriptRequestContent(decoded);
+
+  // Explicit DELETE via curl flag or httpie positional method.
+  if (
+    hasShellHttpClient &&
+    (CURL_DELETE.test(command) || httpieMethod === "delete")
+  ) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-http-delete",
+      reason: "command issues an HTTP DELETE against the target",
+    };
+  }
+
+  // In-script HTTP DELETE (fetch/axios/Playwright) run via a JS runtime.
+  if (
+    (JS_METHOD_DELETE.test(command) && hasScriptHttpClient) ||
+    JS_CLIENT_DELETE_CALL.test(command)
+  ) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-script-http-delete",
+      reason:
+        "command runs an in-script HTTP DELETE (fetch/axios/Playwright) against the target",
+    };
+  }
+
+  if (
+    hasScriptHttpClient &&
+    (SCRIPT_METHOD_WRITE.test(command) ||
+      SCRIPT_CLIENT_WRITE_CALL.test(command) ||
+      SCRIPT_POSITIONAL_WRITE_CALL.test(command)) &&
+    (FINANCIAL_PATH_PATTERN.test(stripUrlAuthorities(scriptRequestContent)) ||
+      FINANCIAL_BODY_PATTERN.test(scriptRequestContent))
+  ) {
+    return {
+      destructive: true,
+      category: "financial-side-effect",
+      ruleId: "cmd-script-financial-write",
+      reason:
+        "command runs an in-script financial mutation (payout/payment/transfer/withdrawal/refund/charge)",
+    };
+  }
+
+  // Method-override to DELETE carried in headers/data — only in an HTTP context.
+  if (
+    (hasShellHttpClient || hasScriptHttpClient) &&
+    METHOD_OVERRIDE_DELETE_PATTERN.test(decoded)
+  ) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-http-override-delete",
+      reason: "command overrides the HTTP method to DELETE",
+    };
+  }
+
+  // Destructive SQL / NoSQL carried in an HTTP client's URL or data body — the
+  // same statement `http_request` blocks, but delivered through curl/wget.
+  if (hasShellHttpClient && httpCarriesDestructiveSql(decoded)) {
+    return {
+      destructive: true,
+      category: "sql-destructive",
+      ruleId: "cmd-http-sql",
+      reason:
+        "command sends a destructive SQL statement in an HTTP request (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)",
+    };
+  }
+  if (hasShellHttpClient && NOSQL_HTTP_DESTRUCTIVE.test(decoded)) {
+    return {
+      destructive: true,
+      category: "nosql-destructive",
+      ruleId: "cmd-http-nosql",
+      reason:
+        "command sends a destructive NoSQL/cache operation in an HTTP request",
+    };
+  }
+
+  // A write request to a delete/destroy route.
+  const writeIndicated =
+    CURL_WRITE_METHOD.test(command) ||
+    CURL_DATA_FLAG.test(command) ||
+    httpieMethod === "post" ||
+    httpieMethod === "put" ||
+    httpieMethod === "patch";
+  if (hasShellHttpClient && writeIndicated) {
+    const urls = command.match(URL_IN_COMMAND) ?? [];
+    if (
+      FINANCIAL_PATH_PATTERN.test(stripUrlAuthorities(shellRequestContent)) ||
+      FINANCIAL_BODY_PATTERN.test(shellRequestContent)
+    ) {
+      return {
+        destructive: true,
+        category: "financial-side-effect",
+        ruleId: "cmd-http-financial-write",
+        reason:
+          "command sends a financial mutation (payout/payment/transfer/withdrawal/refund/charge)",
+      };
+    }
+    for (const rawUrl of urls) {
+      if (DESTRUCTIVE_PATH_PATTERN.test(safeDecode(rawUrl))) {
+        return {
+          destructive: true,
+          category: "http-destructive-path",
+          ruleId: "cmd-http-destructive-path",
+          reason:
+            "command sends a write request to a delete/destroy/purge route",
+        };
+      }
+    }
+  }
+
+  return NOT_DESTRUCTIVE;
+}
+
+const DB_CLIENT_PATTERN =
+  /\b(?:psql|mysql|mariadb|mongosh|mongo|sqlite3|sqlcmd|sqlplus|cqlsh|clickhouse-client|redis-cli|sqlmap)\b|\bcockroach\s+sql\b/i;
+
+// ---------------------------------------------------------------------------
+// Classifiers (pure)
+// ---------------------------------------------------------------------------
+
+/**
+ * Classify an HTTP request. `body` is only inspected when it is a string;
+ * `headers` are folded in so a method-override header is caught. URL and body
+ * are decoded first so encoded payloads are matched.
+ */
+export function classifyHttpAction(input: {
+  method: string;
+  url: string;
+  body?: unknown;
+  headers?: Record<string, unknown>;
+}): DestructiveClassification {
+  const method = input.method.toUpperCase();
+  const decodedUrl = safeDecode(input.url);
+  const decodedUrlAction = stripUrlAuthorities(decodedUrl);
+  const decodedBody = safeDecode(
+    typeof input.body === "string" ? input.body : "",
+  );
+  const headerText = input.headers
+    ? Object.entries(input.headers)
+        .map(([name, value]) => `${name}: ${String(value)}`)
+        .join("\n")
+    : "";
+  const overrideHaystack = `${decodedUrl}\n${decodedBody}\n${headerText}`;
+
+  // The DELETE verb is the canonical "API write-delete".
+  if (method === "DELETE") {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "http-method-delete",
+      reason: "HTTP DELETE removes a resource on the target",
+    };
+  }
+
+  // Method-override to DELETE — honored by some stacks regardless of the verb.
+  if (METHOD_OVERRIDE_DELETE_PATTERN.test(overrideHaystack)) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "http-method-override-delete",
+      reason: "request overrides the HTTP method to DELETE",
+    };
+  }
+
+  // Raw destructive SQL as a statement / injection payload in url or body.
+  if (httpCarriesDestructiveSql(`${decodedUrl}\n${decodedBody}`)) {
+    return {
+      destructive: true,
+      category: "sql-destructive",
+      ruleId: "http-body-sql",
+      reason:
+        "request carries a destructive SQL statement (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)",
+    };
+  }
+
+  // Structured destructive NoSQL/cache op in the body.
+  if (NOSQL_HTTP_DESTRUCTIVE.test(decodedBody)) {
+    return {
+      destructive: true,
+      category: "nosql-destructive",
+      ruleId: "http-body-nosql",
+      reason:
+        "request carries a destructive NoSQL/cache operation (drop/deleteMany/flush)",
+    };
+  }
+
+  // A write method aimed at a delete/destroy route.
+  if (WRITE_METHODS.has(method) && DESTRUCTIVE_PATH_PATTERN.test(decodedUrl)) {
+    return {
+      destructive: true,
+      category: "http-destructive-path",
+      ruleId: "http-destructive-path",
+      reason: "write request targets a delete/destroy/purge route",
+    };
+  }
+
+  if (
+    WRITE_METHODS.has(method) &&
+    (FINANCIAL_PATH_PATTERN.test(decodedUrlAction) ||
+      FINANCIAL_BODY_PATTERN.test(decodedBody))
+  ) {
+    return {
+      destructive: true,
+      category: "financial-side-effect",
+      ruleId: "http-financial-write",
+      reason:
+        "request performs a financial mutation (payout/payment/transfer/withdrawal/refund/charge)",
+    };
+  }
+
+  return NOT_DESTRUCTIVE;
+}
+
+/** Classify a shell command string. */
+export function classifyCommandAction(
+  command: string,
+): DestructiveClassification {
+  for (const { id, test } of HOST_DESTRUCTIVE_RULES) {
+    if (test(command)) {
+      return {
+        destructive: true,
+        category: "host-destructive",
+        ruleId: id,
+        reason: `command performs a catastrophic host operation (${id})`,
+      };
+    }
+  }
+
+  // SQL/NoSQL is destructive only when an actual DB client executes it — a
+  // grep/cat/echo that merely contains "DROP TABLE" or "FLUSHALL" is recon.
+  // Decode first so percent-encoded statements in client args are matched.
+  const decodedCommand = safeDecode(command);
+  if (DB_CLIENT_PATTERN.test(command)) {
+    if (SQL_DESTRUCTIVE_STATEMENT.test(decodedCommand)) {
+      return {
+        destructive: true,
+        category: "sql-destructive",
+        ruleId: "cmd-sql",
+        reason:
+          "command runs a destructive SQL statement via a DB client (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)",
+      };
+    }
+    if (NOSQL_CMD_DESTRUCTIVE.test(decodedCommand)) {
+      return {
+        destructive: true,
+        category: "nosql-destructive",
+        ruleId: "cmd-nosql",
+        reason:
+          "command runs a destructive NoSQL/cache operation via a DB client (drop/deleteMany/flush)",
+      };
+    }
+  }
+
+  return classifyCommandHttp(command);
+}
+
+// ---------------------------------------------------------------------------
+// Enforcement
+// ---------------------------------------------------------------------------
+
+export class DestructiveActionError extends Error {
+  constructor(
+    public readonly classification: Extract<
+      DestructiveClassification,
+      { destructive: true }
+    >,
+    subject: string,
+  ) {
+    super(
+      `Destructive action blocked: ${subject} — ${classification.reason}. ` +
+        `Destructive testing (financial mutations, DB deletes/drops, API write-deletes, catastrophic host operations) is NOT authorized for this engagement. ` +
+        `Prove the flaw without completing the destructive step (e.g. demonstrate the authorization boundary is crossed with a read or a reversible action), or ask the operator to enable destructive testing.`,
+    );
+    this.name = "DestructiveActionError";
+  }
+}
+
+/**
+ * True when the caller has explicitly authorized destructive testing. Absent /
+ * false → destructive actions are blocked (fail-closed, off by default).
+ */
+export function isDestructiveTestingAllowed(ctx: ToolContext): boolean {
+  return ctx.session?.config?.allowDestructiveActions === true;
+}
+
+/**
+ * Assert an HTTP request is permitted. No-op when destructive testing is
+ * authorized; otherwise throws {@link DestructiveActionError} for a
+ * destructive-classified request.
+ *
+ * `http_request` calls this on the FULLY-RESOLVED request (after any
+ * prompt-injection ref in the body expands to a concrete string), so a resolved
+ * payload carrying destructive SQL/NoSQL is classified before the request is
+ * sent. `body` is only inspected when it is a string.
+ */
+export function assertHttpActionAllowed(
+  input: {
+    method: string;
+    url: string;
+    body?: unknown;
+    headers?: Record<string, unknown>;
+  },
+  ctx: ToolContext,
+): void {
+  if (isDestructiveTestingAllowed(ctx)) return;
+  const classification = classifyHttpAction(input);
+  if (classification.destructive) {
+    throw new DestructiveActionError(
+      classification,
+      `${input.method.toUpperCase()} ${input.url}`,
+    );
+  }
+}
+
+/**
+ * Assert a shell command is permitted. No-op when destructive testing is
+ * authorized; otherwise throws {@link DestructiveActionError} for a
+ * destructive-classified command.
+ */
+export function assertCommandActionAllowed(
+  command: string,
+  ctx: ToolContext,
+): void {
+  if (isDestructiveTestingAllowed(ctx)) return;
+  const classification = classifyCommandAction(command);
+  if (classification.destructive) {
+    throw new DestructiveActionError(classification, command);
+  }
+}