openclaw-plugin-vt-sentinel 0.9.2 → 0.11.0

package/dist/path-extractor.js

@@ -39,6 +39,7 @@ exports.addInterestingDirs = addInterestingDirs;
 exports.getInterestingDirs = getInterestingDirs;
 exports.resetInterestingDirs = resetInterestingDirs;
 exports.detectDangerousPatterns = detectDangerousPatterns;
+exports.getDangerousPatternCount = getDangerousPatternCount;
 exports.extractFromCommand = extractFromCommand;
 exports.extractFromOutput = extractFromOutput;
 exports.extractFromWriteTool = extractFromWriteTool;
@@ -129,7 +130,7 @@ const REDIRECT_PATTERNS = [
     /\|\s*Out-File\s+(?:-FilePath\s+)?["']?(\S+?)["']?(?:\s|$)/i,
     /\|\s*Set-Content\s+(?:-Path\s+)?["']?(\S+?)["']?(?:\s|$)/i,
 ];
-// Script execution patterns (the script itself is what we want to scan)
+// Script execution targets — the scripts themselves are what we want to scan.
 const EXEC_PATTERNS = [
     // Unix — shells and interpreters (dash = default /bin/sh on Debian/Ubuntu)
     /(?:bash|sh|zsh|dash|python3?|ruby|perl|node|pwsh|php)\s+["']?(\S+?)["']?(?:\s|$)/,
@@ -151,13 +152,13 @@ const EXEC_PATTERNS = [
     /rundll32(?:\.exe)?\s+["']?([A-Za-z]:[\\\/][^,"'\s]+)/i,
     /rundll32(?:\.exe)?\s+["']?(\\\\[^,"'\s]+)/i, // UNC path DLL
     // Archive extraction — scan the archive BEFORE extraction
-    /tar\s+(?:[a-zA-Z-]*x[a-zA-Z-]*f?)\s+["']?(\S+?)["']?(?:\s|$)/, // tar xf, tar xzf, tar -xvf
-    /unzip\s+(?:-[a-z]+\s+)*["']?(\S+?)["']?(?:\s|$)/, // unzip archive.zip
-    /7z\s+[ex]\s+["']?(\S+?)["']?(?:\s|$)/, // 7z x archive.7z
+    /tar\s+(?:[a-zA-Z-]*x[a-zA-Z-]*f?)\s+["']?(\S+?)["']?(?:\s|$)/,
+    /unzip\s+(?:-[a-z]+\s+)*["']?(\S+?)["']?(?:\s|$)/,
+    /7z\s+[ex]\s+["']?(\S+?)["']?(?:\s|$)/,
     // Linux package install — scan the package before install
     /dpkg\s+(?:-i|--install)\s+["']?(\S+?)["']?(?:\s|$)/,
     /rpm\s+(?:-i|-U|--install|--upgrade)\s+["']?(\S+?)["']?(?:\s|$)/,
-    /apt\s+install\s+["']?(\.\/\S+?)["']?(?:\s|$)/, // apt install ./local.deb
+    /apt\s+install\s+["']?(\.\/\S+?)["']?(?:\s|$)/,
 ];
 // ── Interesting directory detection (dynamic) ────────────────────────
 // Base dirs: always interesting (OS-level temp locations)
@@ -167,7 +168,7 @@ const BASE_INTERESTING_DIRS = (() => {
         dirs.add(fs.realpathSync(os.tmpdir()));
     }
     catch { /* ignore */ }
-    // macOS: /tmp → /private/tmp, /var/tmp → /private/var/tmp
+    // macOS: /tmp -> /private/tmp, /var/tmp -> /private/var/tmp
     try {
         dirs.add(fs.realpathSync('/tmp'));
     }
@@ -259,151 +260,69 @@ function resetInterestingDirs() {
     _workspaceDir = undefined;
     initDirsFromEnv();
 }
-// ── Dangerous command patterns (no file on disk needed) ─────────────
-/**
- * Patterns that indicate dangerous command behavior regardless of whether
- * a malicious file exists on disk. These catch attacks that bypass file-based
- * scanning entirely (pipe-to-shell, SSH injection, data exfiltration, etc.)
- */
-// Pipe-to-shell: remote code piped directly to an interpreter without touching disk
-const PIPE_EXEC_PATTERNS = [
-    // Unix — allow optional sudo/env between pipe and interpreter
-    { pattern: /curl\s+[^|]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh|dash)\b/, description: 'curl piped to shell' },
-    { pattern: /curl\s+[^|]*\|\s*(?:sudo\s+)?(?:python3?|ruby|perl|node|php|deno|bun)\b/, description: 'curl piped to interpreter' },
-    { pattern: /wget\s+[^|]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh|dash)\b/, description: 'wget piped to shell' },
-    { pattern: /wget\s+-O\s*-[^|]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh|dash)\b/, description: 'wget -O- piped to shell' },
-    { pattern: /\|\s*(?:sudo\s+)?base64\s+-d\s*\|\s*(?:sudo\s+)?(?:bash|sh|zsh|dash)\b/, description: 'base64 decode piped to shell' },
-    { pattern: /(?:nc|ncat|netcat|socat|openssl)\s+[^|]*\|\s*(?:sudo\s+)?(?:bash|sh|zsh|dash)\b/, description: 'network listener piped to shell' },
-    { pattern: /eval\s*\$\(curl\b/, description: 'eval with curl subshell' },
-    { pattern: /eval\s*\$\(wget\b/, description: 'eval with wget subshell' },
-    { pattern: /\$\(curl\s[^)]*\)/, description: 'command substitution with curl' },
-    { pattern: /\$\(wget\s[^)]*\)/, description: 'command substitution with wget' },
-    { pattern: /`curl\s[^`]*`/, description: 'backtick curl execution' },
-    { pattern: /`wget\s[^`]*`/, description: 'backtick wget execution' },
-    // Process substitution (Linux/bash-specific fileless technique)
-    { pattern: /(?:bash|sh|zsh|dash)\s+<\(\s*(?:curl|wget)\b/, description: 'process substitution: shell <(curl/wget ...) — fileless execution' },
-    { pattern: /(?:source|\.)(?:\s+)<\(\s*(?:curl|wget)\b/, description: 'source <(curl/wget ...) — fileless sourcing of remote script' },
-    // Linux reverse shells (/dev/tcp is bash built-in, no nc required)
-    { pattern: /\/dev\/tcp\//, description: '/dev/tcp reverse shell (bash built-in network redirection)' },
-    { pattern: /mkfifo\s+\S+\s*;.*(?:nc|ncat|netcat)\b/, description: 'mkfifo + netcat reverse shell pipeline' },
-    { pattern: /mkfifo\s+\S+\s*&&.*(?:nc|ncat|netcat)\b/, description: 'mkfifo + netcat reverse shell pipeline' },
-    // Windows PowerShell
-    { pattern: /IEX\s*\(\s*(?:IWR|Invoke-WebRequest)\b/i, description: 'IEX(IWR ...) — PowerShell download-and-execute' },
-    { pattern: /IEX\s*\(\s*\(?\s*New-Object\s+Net\.WebClient\b/i, description: 'IEX(New-Object Net.WebClient) — PowerShell download-and-execute' },
-    { pattern: /Invoke-Expression\s*\(\s*(?:Invoke-WebRequest|IWR)\b/i, description: 'Invoke-Expression with web request' },
-    { pattern: /Invoke-Expression\s*\(\s*\(?\s*New-Object\b/i, description: 'Invoke-Expression with New-Object' },
-    { pattern: /powershell(?:\.exe)?\s+.*-(?:enc|EncodedCommand)\s+[A-Za-z0-9+\/=]{20,}/i, description: 'PowerShell encoded command execution' },
-    { pattern: /powershell(?:\.exe)?\s+.*-(?:e|ec)\s+[A-Za-z0-9+\/=]{20,}/i, description: 'PowerShell short-flag encoded command' },
-    { pattern: /\|\s*(?:powershell|pwsh)(?:\.exe)?\b/i, description: 'output piped to PowerShell' },
-    // Windows cmd / LOLBins
-    { pattern: /mshta\s+(?:javascript|vbscript)\s*:/i, description: 'mshta script execution' },
-    { pattern: /mshta\s+https?:\/\//i, description: 'mshta URL execution — downloads and runs HTA application' },
-    { pattern: /rundll32(?:\.exe)?\s+javascript:/i, description: 'rundll32 JavaScript execution' },
-    { pattern: /regsvr32\s+.*\/i:https?:\/\//i, description: 'regsvr32 scriptlet download (Squiblydoo attack)' },
-    { pattern: /regsvr32\s+.*\/i:\\\\/i, description: 'regsvr32 scriptlet from UNC path (Squiblydoo)' },
-    // WMI/WMIC fileless execution
-    { pattern: /wmic\s+.*process\s+call\s+create\b/i, description: 'WMIC process creation (fileless execution)' },
-    { pattern: /Invoke-(?:Wmi|Cim)Method\s+.*(?:Win32_Process|Create)\b/i, description: 'WMI/CIM process creation (PowerShell fileless)' },
-    // certutil abuse (LOLBin — base64 payload delivery via signed Microsoft binary)
-    { pattern: /certutil\s+.*-decode\b/i, description: 'certutil -decode (base64 payload delivery)' },
-    // macOS fileless techniques
-    { pattern: /osascript\s+-e\s.*do\s+shell\s+script\b/i, description: 'osascript do shell script (AppleScript execution)' },
-    { pattern: /osascript\s+-e\s.*(?:curl|wget|urllib|URLSession)\b/i, description: 'osascript with network fetch' },
-    { pattern: /python3?\s+-c\s+.*(?:urllib|requests|urlopen|subprocess)\b/, description: 'python -c with network/exec indicators' },
-    { pattern: /ruby\s+-e\s+.*(?:Net::HTTP|open-uri|system|exec)\b/, description: 'ruby -e with network/exec indicators' },
-    { pattern: /perl\s+-e\s+.*(?:LWP|HTTP|system|exec)\b/, description: 'perl -e with network/exec indicators' },
-    { pattern: /node\s+-e\s+.*(?:child_process|https?\.get|fetch|exec)\b/, description: 'node -e with network/exec indicators' },
-    // PowerShell download cradle variants
-    { pattern: /\.Content\s*\|\s*(?:iex|Invoke-Expression)\b/i, description: '.Content piped to IEX (download cradle)' },
-    { pattern: /(?:irm|Invoke-RestMethod)\s+[^|]*\|\s*(?:iex|Invoke-Expression)\b/i, description: 'Invoke-RestMethod piped to IEX (download cradle)' },
-    // UNC path to raw IP (possible SMB relay / NTLM hash capture)
-    { pattern: /\\\\(?:\d{1,3}\.){3}\d{1,3}\\/, description: 'UNC path to IP address (SMB relay/NTLM capture risk)' },
-];
-// SSH key injection: appending to authorized_keys
-const SSH_INJECTION_PATTERNS = [
-    // Unix
-    { pattern: />>\s*~?\/?[^\s]*authorized_keys/, description: 'SSH authorized_keys append' },
-    { pattern: />>\s*~?\/?\.ssh\//, description: 'append to .ssh directory' },
-    { pattern: /tee\s+-a\s+[^\s]*authorized_keys/, description: 'tee append to authorized_keys' },
-    { pattern: /echo\s+.*ssh-(?:rsa|ed25519|ecdsa)\b/, description: 'echo SSH public key' },
-    // Windows (same concept, Windows-style paths)
-    { pattern: />>?\s*[A-Za-z]:[\\\/][^\s]*[\\\/]\.ssh[\\\/]authorized_keys/i, description: 'SSH authorized_keys append (Windows path)' },
-    { pattern: /Add-Content\s+.*authorized_keys/i, description: 'Add-Content to authorized_keys (PowerShell)' },
-    { pattern: /Out-File\s+.*-Append\s+.*authorized_keys/i, description: 'Out-File -Append to authorized_keys (PowerShell)' },
-];
-// Data exfiltration: sending data to known exfiltration endpoints
-const EXFIL_DOMAINS = 'webhook\\.site|requestbin\\.com|pipedream\\.net|hookbin\\.com|burpcollaborator\\.net|interact\\.sh|canarytokens\\.com|oastify\\.com';
-const EXFILTRATION_PATTERNS = [
-    // Unix
-    { pattern: new RegExp(`(?:curl|wget|fetch)\\s+[^|]*(?:${EXFIL_DOMAINS})`), description: 'data sent to known exfiltration endpoint' },
-    { pattern: /(?:curl|wget)\s+.*-(?:d|X\s*POST|--data)\s.*(?:\.env|passwd|shadow|id_rsa|credentials)/, description: 'sensitive file content sent via HTTP' },
-    { pattern: /cat\s+[^\s]*(?:\.env|\.aws\/credentials|id_rsa|\.ssh\/|\.gnupg\/)[^\s]*\s*\|.*(?:curl|wget|nc)\b/, description: 'sensitive file piped to network tool' },
-    { pattern: /(?:curl|wget)\s+.*-(?:d|X\s*POST|--data)\s.*\$\(cat\b/, description: 'file content sent via curl/wget POST' },
-    // Windows PowerShell
-    { pattern: new RegExp(`(?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\\s+.*(?:${EXFIL_DOMAINS})`, 'i'), description: 'data sent to exfiltration endpoint (PowerShell)' },
-    { pattern: /\[Net\.WebClient\].*Upload(?:String|Data|File)\s*\(/i, description: 'Net.WebClient upload (PowerShell exfiltration)' },
-    { pattern: /\.UploadString\s*\(\s*["']https?:\/\//i, description: 'UploadString to URL (PowerShell exfiltration)' },
-];
-// Windows persistence patterns (scheduled tasks, services, registry Run keys)
-const PERSISTENCE_PATTERNS = [
-    // Scheduled tasks (#1 Windows persistence mechanism)
-    { pattern: /schtasks\s+\/create\b/i, description: 'Scheduled task creation (persistence — survives reboot)' },
-    { pattern: /Register-ScheduledTask\b/i, description: 'Register-ScheduledTask (PowerShell persistence)' },
-    // Registry Run keys (#2 persistence mechanism)
-    { pattern: /reg\s+add\s+["']?HK(?:CU|LM).*\\(?:Run|RunOnce)\b/i, description: 'Registry Run key modification (auto-start persistence)' },
-    { pattern: /(?:Set-ItemProperty|New-ItemProperty)\s+.*\\(?:Run|RunOnce)\b/i, description: 'Registry Run key via PowerShell (auto-start persistence)' },
-    // Windows service creation (runs as SYSTEM)
-    { pattern: /sc\s+create\s+\w+\s+binPath=/i, description: 'Windows service creation (SYSTEM persistence)' },
-    { pattern: /New-Service\b/i, description: 'New-Service (PowerShell service creation)' },
-];
-// Credential/secret access patterns
-const CREDENTIAL_PATTERNS = [
-    // Unix
-    { pattern: /cat\s+[^\s]*\.env\b[^\s]*\s*\|/, description: '.env file piped to another command' },
-    { pattern: /cat\s+[^\s]*id_rsa\b[^\s]*\s*\|/, description: 'SSH private key piped' },
-    { pattern: /cat\s+[^\s]*\.aws\/credentials\b[^\s]*\s*\|/, description: 'AWS credentials piped' },
-    { pattern: /(?:curl|wget)\s+.*--header.*(?:Authorization|Bearer|Token)\s*:\s*\$/, description: 'dynamic auth header exfiltration' },
-    // Windows
-    { pattern: /(?:type|Get-Content|gc)\s+[^\s|]*\.env\b[^\s|]*\s*\|/i, description: '.env read and piped (Windows)' },
-    { pattern: /(?:type|Get-Content|gc)\s+[^\s|]*id_rsa\b[^\s|]*\s*\|/i, description: 'SSH private key read and piped (Windows)' },
-    { pattern: /(?:type|Get-Content|gc)\s+[^\s|]*[\\\/]\.aws[\\\/]credentials\b[^\s|]*\s*\|/i, description: 'AWS credentials read and piped (Windows)' },
-    { pattern: /\$env:\w+.*\|\s*(?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i, description: 'environment variable piped to web request (PowerShell)' },
-];
+const SIGNATURE_CATEGORY_MAP = {
+    pipeExec: { category: 'pipe_execution', severity: 'critical' },
+    sshInjection: { category: 'ssh_injection', severity: 'critical' },
+    exfiltration: { category: 'data_exfiltration', severity: 'high' },
+    persistence: { category: 'persistence', severity: 'high' },
+    credential: { category: 'credential_access', severity: 'high' },
+};
+const DANGEROUS_SIGNATURES = (() => {
+    const compiled = [];
+    const jsonPath = path.join(__dirname, 'signatures', 'dangerous-commands.json');
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(jsonPath, 'utf-8'));
+    }
+    catch (err) {
+        console.error(`[vt-sentinel] failed to load dangerous-commands.json at ${jsonPath}: ${String(err)}`);
+        return compiled;
+    }
+    for (const key of Object.keys(SIGNATURE_CATEGORY_MAP)) {
+        const entries = data[key];
+        if (!Array.isArray(entries))
+            continue;
+        const meta = SIGNATURE_CATEGORY_MAP[key];
+        for (const entry of entries) {
+            try {
+                compiled.push({
+                    pattern: new RegExp(entry.pattern, entry.flags || ''),
+                    description: entry.description,
+                    category: meta.category,
+                    severity: meta.severity,
+                });
+            }
+            catch (err) {
+                console.error(`[vt-sentinel] invalid signature pattern in ${key}: ${entry.description} — ${String(err)}`);
+            }
+        }
+    }
+    return compiled;
+})();
 /**
  * Detect dangerous patterns in a command string that indicate attacks
  * which bypass file-based scanning (pipe-to-shell, SSH injection, exfiltration).
- *
  * Returns all matched patterns, or an empty array if the command is safe.
  */
 function detectDangerousPatterns(command) {
     const matches = [];
-    for (const { pattern, description } of PIPE_EXEC_PATTERNS) {
-        if (pattern.test(command)) {
-            matches.push({ category: 'pipe_execution', description, severity: 'critical' });
-        }
-    }
-    for (const { pattern, description } of SSH_INJECTION_PATTERNS) {
-        if (pattern.test(command)) {
-            matches.push({ category: 'ssh_injection', description, severity: 'critical' });
-        }
-    }
-    for (const { pattern, description } of EXFILTRATION_PATTERNS) {
-        if (pattern.test(command)) {
-            matches.push({ category: 'data_exfiltration', description, severity: 'high' });
-        }
-    }
-    for (const { pattern, description } of CREDENTIAL_PATTERNS) {
-        if (pattern.test(command)) {
-            matches.push({ category: 'credential_access', description, severity: 'high' });
-        }
-    }
-    for (const { pattern, description } of PERSISTENCE_PATTERNS) {
-        if (pattern.test(command)) {
-            matches.push({ category: 'persistence', description, severity: 'high' });
+    for (const sig of DANGEROUS_SIGNATURES) {
+        if (sig.pattern.test(command)) {
+            matches.push({ category: sig.category, description: sig.description, severity: sig.severity });
         }
     }
     return matches;
 }
+/**
+ * Return the number of compiled signatures (diagnostics/tests).
+ */
+function getDangerousPatternCount() {
+    return DANGEROUS_SIGNATURES.length;
+}
+/** Build a global-flagged copy of a regex so matchAll can iterate. */
+function toGlobal(re) {
+    return re.flags.includes('g') ? re : new RegExp(re.source, re.flags + 'g');
+}
 /**
  * Extract file paths from an exec tool command string.
  */
@@ -417,52 +336,38 @@ function extractFromCommand(command) {
         seen.add(clean);
         results.push({ path: clean, source, reason });
     };
-    // Download targets (curl -o, wget -O) — global exec to catch multiple in one command
+    // Download targets (curl -o, wget -O) — iterate via matchAll to catch multiple in one command
     for (const re of DOWNLOAD_PATTERNS) {
-        const globalRe = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
-        let m;
-        while ((m = globalRe.exec(command)) !== null) {
+        for (const m of command.matchAll(toGlobal(re))) {
             if (m[1])
                 add(m[1], 'download_target', `Download target in: ${re.source}`);
         }
     }
     // Redirect targets (> file, tee file)
     for (const re of REDIRECT_PATTERNS) {
-        const globalRe = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
-        let m;
-        while ((m = globalRe.exec(command)) !== null) {
+        for (const m of command.matchAll(toGlobal(re))) {
             if (m[1] && m[1] !== '/dev/null')
                 add(m[1], 'redirect_target', `Output redirected to file`);
         }
     }
     // Script execution targets
     for (const re of EXEC_PATTERNS) {
-        const globalRe = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
-        let m;
-        while ((m = globalRe.exec(command)) !== null) {
+        for (const m of command.matchAll(toGlobal(re))) {
             if (m[1])
                 add(m[1], 'exec_target', `Script being executed`);
         }
     }
     // Windows %ENV_VAR%\path expansion (e.g., %TEMP%\payload.exe)
-    {
-        const envRe = new RegExp(WIN_ENV_PATH_RE.source, WIN_ENV_PATH_RE.flags);
-        let m;
-        while ((m = envRe.exec(command)) !== null) {
-            const expanded = expandWinEnvVar(m[1], m[2]);
-            if (expanded)
-                add(expanded, 'command_param', `Expanded Windows env var path %${m[1]}%`);
-        }
+    for (const m of command.matchAll(toGlobal(WIN_ENV_PATH_RE))) {
+        const expanded = expandWinEnvVar(m[1], m[2]);
+        if (expanded)
+            add(expanded, 'command_param', `Expanded Windows env var path %${m[1]}%`);
     }
     // PowerShell $env:VAR\path expansion (e.g., $env:TEMP\payload.exe)
-    {
-        const psRe = new RegExp(PS_ENV_PATH_RE.source, PS_ENV_PATH_RE.flags);
-        let m;
-        while ((m = psRe.exec(command)) !== null) {
-            const expanded = expandWinEnvVar(m[1], m[2]);
-            if (expanded)
-                add(expanded, 'command_param', `Expanded PowerShell env path $env:${m[1]}`);
-        }
+    for (const m of command.matchAll(toGlobal(PS_ENV_PATH_RE))) {
+        const expanded = expandWinEnvVar(m[1], m[2]);
+        if (expanded)
+            add(expanded, 'command_param', `Expanded PowerShell env path $env:${m[1]}`);
     }
     return results;
 }
@@ -548,31 +453,20 @@ function extractFromOutput(output) {
         results.push({ path: clean, source: 'tool_output', reason: 'File path found in tool output' });
     };
     // Unix paths (unquoted)
-    let match;
-    const unixRe = new RegExp(UNIX_PATH_RE.source, UNIX_PATH_RE.flags);
-    while ((match = unixRe.exec(output)) !== null) {
-        addPath(match[1]);
-    }
+    for (const m of output.matchAll(toGlobal(UNIX_PATH_RE)))
+        addPath(m[1]);
     // Unix quoted paths (handles spaces like "/Users/foo/Application Support/...")
-    const unixQuotedRe = new RegExp(UNIX_QUOTED_PATH_RE.source, UNIX_QUOTED_PATH_RE.flags);
-    while ((match = unixQuotedRe.exec(output)) !== null) {
-        addPath(match[1]);
-    }
+    for (const m of output.matchAll(toGlobal(UNIX_QUOTED_PATH_RE)))
+        addPath(m[1]);
     // Windows paths (unquoted)
-    const winRe = new RegExp(WIN_PATH_RE.source, WIN_PATH_RE.flags);
-    while ((match = winRe.exec(output)) !== null) {
-        addPath(match[1]);
-    }
+    for (const m of output.matchAll(toGlobal(WIN_PATH_RE)))
+        addPath(m[1]);
     // Windows quoted paths (handles spaces)
-    const winQuotedRe = new RegExp(WIN_QUOTED_PATH_RE.source, WIN_QUOTED_PATH_RE.flags);
-    while ((match = winQuotedRe.exec(output)) !== null) {
-        addPath(match[1]);
-    }
+    for (const m of output.matchAll(toGlobal(WIN_QUOTED_PATH_RE)))
+        addPath(m[1]);
     // UNC paths (\\server\share\file)
-    const uncRe = new RegExp(UNC_PATH_RE.source, UNC_PATH_RE.flags);
-    while ((match = uncRe.exec(output)) !== null) {
-        addPath(match[1]);
-    }
+    for (const m of output.matchAll(toGlobal(UNC_PATH_RE)))
+        addPath(m[1]);
     return results;
 }
 /**
@@ -593,9 +487,6 @@ function extractFromReadTool(params) {
         return [];
     return [{ path: p, source: 'read_target', reason: 'File read by agent' }];
 }
-/**
- * Filter paths to only include files that actually exist on disk.
- */
 /**
  * Expand ~ to $HOME (Node doesn't expand tilde in fs operations).
  */
@@ -648,59 +539,47 @@ function filterExisting(paths) {
  */
 function extractAllPaths(command) {
     const paths = new Set();
-    let match;
     // Unix paths (unquoted)
-    const unixRe = new RegExp(UNIX_PATH_RE.source, UNIX_PATH_RE.flags);
-    while ((match = unixRe.exec(command)) !== null) {
-        const p = match[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
+    for (const m of command.matchAll(toGlobal(UNIX_PATH_RE))) {
+        const p = m[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
         if (p.length >= 2)
             paths.add(p);
     }
     // Unix quoted paths (handles spaces)
-    const unixQuotedRe = new RegExp(UNIX_QUOTED_PATH_RE.source, UNIX_QUOTED_PATH_RE.flags);
-    while ((match = unixQuotedRe.exec(command)) !== null) {
-        const p = match[1].replace(/[.,;:!?)}\]]+$/, '');
+    for (const m of command.matchAll(toGlobal(UNIX_QUOTED_PATH_RE))) {
+        const p = m[1].replace(/[.,;:!?)}\]]+$/, '');
         if (p.length >= 2)
             paths.add(p);
     }
     // Windows paths (unquoted)
-    const winRe = new RegExp(WIN_PATH_RE.source, WIN_PATH_RE.flags);
-    while ((match = winRe.exec(command)) !== null) {
-        const p = match[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
+    for (const m of command.matchAll(toGlobal(WIN_PATH_RE))) {
+        const p = m[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
         if (p.length >= 4)
             paths.add(p); // minimum: C:\x
     }
     // Windows quoted paths (handles spaces like C:\Program Files\...)
-    const winQuotedRe = new RegExp(WIN_QUOTED_PATH_RE.source, WIN_QUOTED_PATH_RE.flags);
-    while ((match = winQuotedRe.exec(command)) !== null) {
-        const p = match[1].replace(/[.,;:!?)}\]]+$/, '');
+    for (const m of command.matchAll(toGlobal(WIN_QUOTED_PATH_RE))) {
+        const p = m[1].replace(/[.,;:!?)}\]]+$/, '');
         if (p.length >= 4)
             paths.add(p);
     }
     // UNC paths (\\server\share\file)
-    const uncRe = new RegExp(UNC_PATH_RE.source, UNC_PATH_RE.flags);
-    while ((match = uncRe.exec(command)) !== null) {
-        const p = match[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
+    for (const m of command.matchAll(toGlobal(UNC_PATH_RE))) {
+        const p = m[1].replace(/["']+$/g, '').replace(/[.,;:!?)}\]]+$/, '');
         if (p.length >= 4)
             paths.add(p);
     }
     // Windows %ENV%\path expansion
-    {
-        const envRe = new RegExp(WIN_ENV_PATH_RE.source, WIN_ENV_PATH_RE.flags);
-        while ((match = envRe.exec(command)) !== null) {
-            const expanded = expandWinEnvVar(match[1], match[2]);
-            if (expanded)
-                paths.add(expanded);
-        }
+    for (const m of command.matchAll(toGlobal(WIN_ENV_PATH_RE))) {
+        const expanded = expandWinEnvVar(m[1], m[2]);
+        if (expanded)
+            paths.add(expanded);
     }
     // PowerShell $env:VAR\path expansion
-    {
-        const psRe = new RegExp(PS_ENV_PATH_RE.source, PS_ENV_PATH_RE.flags);
-        while ((match = psRe.exec(command)) !== null) {
-            const expanded = expandWinEnvVar(match[1], match[2]);
-            if (expanded)
-                paths.add(expanded);
-        }
+    for (const m of command.matchAll(toGlobal(PS_ENV_PATH_RE))) {
+        const expanded = expandWinEnvVar(m[1], m[2]);
+        if (expanded)
+            paths.add(expanded);
     }
     return Array.from(paths);
 }

package/dist/scanner.d.ts

@@ -34,35 +34,42 @@ export declare class Scanner {
     private limiter;
     private maxFileSizeMb;
     private sensitivePolicy;
-    /** In-memory consent cache for "ask_once" policy. null = not yet asked. */
+    private semanticPolicy;
+    /** In-memory consent cache for "ask_once" policy on sensitive files. null = not yet asked. */
     private consentDecision;
+    /** In-memory consent cache for "ask_once" policy on semantic files. null = not yet asked. */
+    private consentDecisionSemantic;
     private logger;
     constructor(apiKey: string, logger: {
         info: (m: string) => void;
         warn: (m: string) => void;
         error: (m: string) => void;
-    }, maxFileSizeMb?: number, sensitivePolicy?: SensitiveFilePolicy, useVtai?: boolean);
+    }, maxFileSizeMb?: number, sensitivePolicy?: SensitiveFilePolicy, useVtai?: boolean, semanticPolicy?: SensitiveFilePolicy);
     /**
      * Record the user's consent decision (used by the tool when the user responds).
      * When policy is "ask_once", this persists for the session.
+     * @param consentGroup — 'sensitive' or 'semantic', determines which consent cache to update.
      */
-    recordConsent(upload: boolean): void;
+    recordConsent(upload: boolean, consentGroup?: 'sensitive' | 'semantic'): void;
     /** Update maxFileSizeMb at runtime without rebuilding scanner. */
     updateMaxFileSizeMb(mb: number): void;
     /** Update sensitiveFilePolicy at runtime. Resets consent decision. */
     updateSensitivePolicy(policy: SensitiveFilePolicy): void;
+    /** Update semanticFilePolicy at runtime. Resets semantic consent decision. */
+    updateSemanticPolicy(policy: SensitiveFilePolicy): void;
     /**
      * Full scan of a file: classify → hash → VT lookup → code insight if applicable.
      * When force=true (manual scan), always do at least a hash check even for SAFE/MEDIA files.
+     * When hashOnly=true: only check hash against VT, never upload regardless of category.
      */
-    scanFile(filePath: string, force?: boolean, precomputedHash?: string): Promise<ScanResult>;
+    scanFile(filePath: string, force?: boolean, precomputedHash?: string, hashOnly?: boolean): Promise<ScanResult>;
     /**
      * Scan a HIGH_RISK or SEMANTIC_RISK file: hash lookup → upload if unknown.
      * Code Insight is extracted automatically by fromReport() (same as all categories).
      */
     private scanAutoUpload;
     /**
-     * Scan a SENSITIVE file according to the configured policy.
+     * Scan a SENSITIVE or SEMANTIC_RISK file according to the given policy.
      *
      * Step 1 (always): Check hash — this reveals nothing about file content.
      *   - If VT knows the hash → report findings (malicious PDF templates, etc.)
@@ -72,6 +79,8 @@ export declare class Scanner {
      *   - "always_upload"   → upload to VT
      *   - "ask"             → return needs_consent every time
      *   - "ask_once"        → return needs_consent the first time, then use remembered decision
+     *
+     * @param consentGroup — 'sensitive' or 'semantic', determines which consent cache to use
      */
     private scanSensitive;
     /**
@@ -79,6 +88,11 @@ export declare class Scanner {
      * Always checks hash; does NOT upload (no privacy concern but no reason to upload safe files).
      */
     private scanForced;
+    /**
+     * Hash-only check: rate-limited hash lookup, never uploads.
+     * Used when hashOnly=true (e.g., files read by the agent).
+     */
+    private hashCheckOnly;
     private uploadSensitive;
     private needsConsent;
     /**