ssh-mcp 2.13.0 → 2.14.0

package/build/policy/classifier.js

@@ -41,7 +41,7 @@ const SHELL_CONTROL_CHARS = /[;&|<>`$(){}\n\r]/;
  * branch, which only runs when the command words matched a READERS key
  * exactly — never sees one either.
  */
-function firstUnquotedGlobWord(command, honorQuotes = true) {
+function firstUnquotedGlobWord(command, honorQuotes = true, dialect = 'posix') {
     let quote = null;
     let escaped = false;
     let word = '';
@@ -56,7 +56,7 @@ function firstUnquotedGlobWord(command, honorQuotes = true) {
         if (quote) {
             // Backslash is literal inside single quotes; inside double quotes it
             // escapes — the same distinction the tokeniser makes.
-            if (ch === '\\' && quote === '"') {
+            if (dialect === 'posix' && ch === '\\' && quote === '"') {
                 escaped = true;
                 continue;
             }
@@ -66,7 +66,7 @@ function firstUnquotedGlobWord(command, honorQuotes = true) {
                 word += ch;
             continue;
         }
-        if (ch === '\\') {
+        if (dialect === 'posix' && ch === '\\') {
             escaped = true;
             continue;
         }
@@ -90,7 +90,7 @@ function firstUnquotedGlobWord(command, honorQuotes = true) {
     // `tokenizeSegmentsDetailed`). Judge it the same way here: in that reading
     // the glob character is unquoted.
     if (honorQuotes && quote !== null)
-        return firstUnquotedGlobWord(command, false);
+        return firstUnquotedGlobWord(command, false, dialect);
     return globInWord ? word : null;
 }
 /**
@@ -822,9 +822,11 @@ const MAX_NESTING_DEPTH = 8;
  * Not a shell parser. Variable expansion, arithmetic and here-documents are out of scope —
  * `hasUnnameableCommand` is what refuses a command word this cannot resolve.
  */
-function tokenizeSegments(command) {
-    return tokenizeSegmentsDetailed(command).map((segment) => segment.words);
+function tokenizeSegments(command, dialect = 'posix') {
+    return tokenizeSegmentsDetailed(command, true, dialect).map((segment) => segment.words);
 }
+/** Inside double quotes, the characters POSIX lets a backslash escape. */
+const DOUBLE_QUOTE_ESCAPABLE = new Set(['$', '`', '"', '\\', '\n']);
 /**
  * The same split, keeping the separator that introduced each segment.
  *
@@ -832,7 +834,7 @@ function tokenizeSegments(command) {
  * and `&` merely sequence, and a rule about pipes must not fire on a rule about sequences.
  * Deriving both views from one tokeniser is what stops the two from drifting apart.
  */
-function tokenizeSegmentsDetailed(command, honorQuotes = true) {
+function tokenizeSegmentsDetailed(command, honorQuotes = true, dialect = 'posix') {
     const segments = [];
     let pending = '';
     let words = [];
@@ -867,7 +869,8 @@ function tokenizeSegmentsDetailed(command, honorQuotes = true) {
         words = [];
         pending = sep;
     };
-    for (const ch of command) {
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
         if (escaped) {
             // A backslash quotes the next character, so `\reboot` runs reboot. Keeping the
             // character and dropping the backslash is what the shell does.
@@ -877,8 +880,18 @@ function tokenizeSegmentsDetailed(command, honorQuotes = true) {
         }
         if (quote) {
             // Backslash is literal inside single quotes; inside double quotes it escapes.
-            if (ch === '\\' && quote === '"') {
-                escaped = true;
+            if (dialect === 'posix' && ch === '\\' && quote === '"') {
+                const next = command[i + 1];
+                // POSIX keeps `\x` before an ordinary character: only $ ` " \ and a
+                // newline are escapable, so the backslash survives into the word
+                // (GHSA-972x-g47g-3922's second finding — dropping it misread both
+                // dialects at once). At end of string there is no next character to
+                // protect, and the open quote sends the whole scan to the fallback.
+                if (next === undefined || DOUBLE_QUOTE_ESCAPABLE.has(next)) {
+                    escaped = true;
+                    continue;
+                }
+                current += ch;
                 continue;
             }
             if (ch === quote)
@@ -887,7 +900,7 @@ function tokenizeSegmentsDetailed(command, honorQuotes = true) {
                 current += ch;
             continue;
         }
-        if (ch === '\\') {
+        if (dialect === 'posix' && ch === '\\') {
             escaped = true;
             continue;
         }
@@ -913,7 +926,7 @@ function tokenizeSegmentsDetailed(command, honorQuotes = true) {
     // `privileged` before this tokeniser and `safe` after. So fall back to the scan that
     // treats the quote character as ordinary text, which splits and still sees `sudo id`.
     if (quote !== null)
-        return tokenizeSegmentsDetailed(command, false);
+        return tokenizeSegmentsDetailed(command, false, dialect);
     return segments;
 }
 /**
@@ -922,20 +935,26 @@ function tokenizeSegmentsDetailed(command, honorQuotes = true) {
  * Segments are rejoined with `; ` so a pattern cannot match across two commands that the
  * shell would run separately.
  */
-let lastNormalizedInput = null;
-let lastNormalizedOutput = '';
-function normalizeCommand(command) {
+const normalizedCache = new Map();
+function normalizeCommand(command, dialect) {
     // One evaluate asks for this about nineteen times, once per regex rule, and each ask
     // re-ran the tokeniser over the whole command. The asks arrive in a row on the same
-    // input, so a one-entry cache removes almost all of it.
-    if (command === lastNormalizedInput)
-        return lastNormalizedOutput;
-    lastNormalizedInput = command;
-    lastNormalizedOutput = normalizeUncached(command);
-    return lastNormalizedOutput;
+    // input, so a small cache, evicting the oldest inserted entry, removes almost
+    // all of it. The key carries the dialect because both readings of one command
+    // are asked about in the same row.
+    const key = `${dialect}\u0000${command}`;
+    const hit = normalizedCache.get(key);
+    if (hit !== undefined)
+        return hit;
+    const value = normalizeUncached(command, dialect);
+    normalizedCache.set(key, value);
+    if (normalizedCache.size > 8) {
+        normalizedCache.delete(normalizedCache.keys().next().value);
+    }
+    return value;
 }
-function normalizeUncached(command) {
-    return tokenizeSegments(command)
+function normalizeUncached(command, dialect) {
+    return tokenizeSegments(command, dialect)
         .map((words) => words.map((w) => (QUOTED_CONTENT.test(w) ? PLACEHOLDER : w)).join(' '))
         .join('; ');
 }
@@ -976,8 +995,8 @@ const PLACEHOLDER = '\u0000';
  * inside a quoted argument into a real one — `grep -E "warn|reboot" syslog` became an
  * unconditional refusal, which is the mention-vs-invocation bug of #91 all over again.
  */
-function matchesEitherForm(command, test) {
-    return test(command) || test(normalizeCommand(command));
+function matchesEitherForm(command, test, dialect) {
+    return test(command) || test(normalizeCommand(command, dialect));
 }
 /**
  * The commands hiding inside a command.
@@ -1008,7 +1027,7 @@ function matchesEitherForm(command, test) {
  *   backticks and `sh -c` are certain carriers and keep reaching the
  *   denylist either way.
  */
-export function nestedCommands(command, speculativeOperands = true) {
+export function nestedCommands(command, speculativeOperands = true, dialect = 'posix') {
     const found = [];
     // `$(...)`, `<(...)`, `>(...)` — scanned rather than matched, because a regex
     // cannot balance parentheses and `echo $(echo $(sudo id))` is the case that
@@ -1046,7 +1065,7 @@ export function nestedCommands(command, speculativeOperands = true) {
     // scan above does not see it. Read each segment's command word rather than scanning
     // every word: matching a mention rather than an invocation is #91, and
     // `cat /usr/bin/python3` names an interpreter without running one.
-    const segments = tokenizeSegmentsDetailed(command);
+    const segments = tokenizeSegmentsDetailed(command, true, dialect);
     for (const { words } of segments) {
         // Every word, not just the command word. Stopping at the head lost the carrier behind
         // any wrapper this file does not list: `xargs -I {} sh -c 'sudo id'` stops on `{}`, and
@@ -1277,9 +1296,16 @@ const BARE_NUMERIC = /^\d+(\.\d+)?[smhd]?$/;
  * `\sudo`, `'sudo'` and `"sudo"` all execute sudo — the backslash only
  * suppresses alias expansion — but a verbatim string comparison sees three
  * different words. Without this, a one-character edit walks around the check.
+ *
+ * One surrounding quote pair, and nothing else: the scanner has already
+ * resolved escapes by the time a word reaches this, in both the
+ * quote-honouring scan and the `honorQuotes = false` fallback, so a second
+ * pass here could only remove backslashes the dialect meant to keep — the
+ * literal ones inside single quotes, and the POSIX-retained ones inside
+ * double quotes (GHSA-972x-g47g-3922).
  */
 function unquote(word) {
-    return word.replace(/^(['"])(.*)\1$/, '$2').replace(/\\(.)/g, '$1');
+    return word.replace(/^(['"])(.*)\1$/, '$2');
 }
 /**
  * Privilege-prefix flags that consume the next argument, so `sudo -u root
@@ -1291,14 +1317,14 @@ const PREFIX_VALUE_FLAGS = new Set([
     '--user', '--group', '--prompt', '--close-from', '--host', '--role', '--type',
     '--other-user', '--command',
 ]);
-/** `/sbin/reboot` and `reboot` are the same invocation. */
+/** `/sbin/reboot`, `C:\Windows\reboot.exe` and `reboot` are the same invocation. */
 function stripPath(word) {
-    const slash = word.lastIndexOf('/');
-    return slash === -1 ? word : word.slice(slash + 1);
+    const cut = Math.max(word.lastIndexOf('/'), word.lastIndexOf('\\'));
+    return cut === -1 ? word : word.slice(cut + 1);
 }
-function parseSegments(command) {
+function parseSegments(command, dialect = 'posix') {
     const segments = [];
-    for (const words of tokenizeSegments(command)) {
+    for (const words of tokenizeSegments(command, dialect)) {
         const segment = parseWords(words);
         if (segment !== null)
             segments.push(segment);
@@ -1383,8 +1409,8 @@ function elevatedBinary(words) {
  * holding, and `echo hi; sudo id` recorded `binary: "echo"` against a
  * privileged decision — in the audit log, the OTel span and OPA's input (#134).
  */
-function elevatedBinaryOf(command) {
-    for (const words of tokenizeSegments(command)) {
+function elevatedBinaryOf(command, dialect = 'posix') {
+    for (const words of tokenizeSegments(command, dialect)) {
         const found = elevatedBinary(words);
         if (found !== null)
             return found;
@@ -1411,8 +1437,8 @@ function elevatedBinaryOf(command) {
  * `invokedWords` also reads it, and widening what counts as "the command"
  * there is a different, larger change this fix does not take on.
  */
-function hasDisqualifyingArgs(command) {
-    return tokenizeSegments(command).some((words) => {
+function hasDisqualifyingArgs(command, dialect = 'posix') {
+    return tokenizeSegments(command, dialect).some((words) => {
         const idx = effectiveCommandIndex(words);
         if (idx === -1)
             return false;
@@ -1420,9 +1446,9 @@ function hasDisqualifyingArgs(command) {
         return rule !== undefined && words.slice(idx + 1).some((arg) => rule.test(arg));
     });
 }
-function invokedWords(command) {
+function invokedWords(command, dialect = 'posix') {
     const invoked = [];
-    for (const { head, args } of parseSegments(command)) {
+    for (const { head, args } of parseSegments(command, dialect)) {
         invoked.push(head);
         // `systemctl reboot` restarts the host. Reading a unit that happens to be
         // named after a power action is rare enough that erring towards refusal
@@ -1444,11 +1470,11 @@ const DOWNLOADERS = new Set(['curl', 'wget']);
  * runs a shell when the download fails, which is not meaningfully safer than
  * running one when it succeeds.
  */
-function pipesDownloadIntoShell(command) {
+function pipesDownloadIntoShell(command, dialect = 'posix') {
     // One head per pipe stage. Splitting on every separator would make `curl -O x;
     // bash build.sh` — download, then run a local script — match a rule whose label says
     // "piping a download into a shell", on a list that cannot be switched off.
-    const segments = tokenizeSegmentsDetailed(command);
+    const segments = tokenizeSegmentsDetailed(command, true, dialect);
     const heads = segments
         .filter((segment, i) => i === 0 || segment.sep === '|')
         .map((segment) => parseWords(segment.words)?.head);
@@ -1458,8 +1484,8 @@ function pipesDownloadIntoShell(command) {
     return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
 }
 /** `dd … of=/dev/sda` — writing an image straight onto a block device. */
-function writesToDevice(command) {
-    return parseSegments(command).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+function writesToDevice(command, dialect = 'posix') {
+    return parseSegments(command, dialect).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
 }
 /**
  * `chown -R … /` — a recursive chown whose target is the filesystem root.
@@ -1467,8 +1493,8 @@ function writesToDevice(command) {
  * The last non-flag argument is the target; `chown -R app:app /srv/app` is
  * ordinary and stays allowed.
  */
-function chownsRoot(command) {
-    return parseSegments(command).some(({ head, args }) => {
+function chownsRoot(command, dialect = 'posix') {
+    return parseSegments(command, dialect).some(({ head, args }) => {
         if (head !== 'chown' || !args.includes('-R'))
             return false;
         const positional = args.filter((a) => !a.startsWith('-'));
@@ -1478,18 +1504,18 @@ function chownsRoot(command) {
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({
         label: String(re),
-        test: (c) => matchesEitherForm(c, (form) => re.test(form)),
+        test: (c, dialect) => matchesEitherForm(c, (form) => re.test(form), dialect),
     })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
-        test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
+        test: (command, dialect) => invokedWords(command, dialect).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
     },
     {
         label: 'piping a download into a shell (curl or wget into sh, bash or zsh)',
-        test: pipesDownloadIntoShell,
+        test: (c, dialect) => pipesDownloadIntoShell(c, dialect),
     },
-    { label: 'dd writing to a block device (of=/dev/…)', test: writesToDevice },
-    { label: 'a recursive chown of the filesystem root', test: chownsRoot },
+    { label: 'dd writing to a block device (of=/dev/…)', test: (c, dialect) => writesToDevice(c, dialect) },
+    { label: 'a recursive chown of the filesystem root', test: (c, dialect) => chownsRoot(c, dialect) },
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:
@@ -1498,8 +1524,21 @@ const FORBIDDEN_RULES = [
  * permit `sudo reboot`.
  */
 export function findForbiddenMatch(command, depth = 0) {
+    // The engine calls this directly, so it is a decision point of its own and
+    // reads both dialects like `classifyCommand` does: a refusal under either
+    // reading is a refusal. The destructive-class consultation *inside* a
+    // dialect pass (`isDestructive`) stays in-dialect — that pass is already one
+    // reading of the whole string.
+    if (command.includes('\\')) {
+        const windows = findForbiddenMatchInDialect(command, depth, 'windows');
+        if (windows !== null)
+            return windows;
+    }
+    return findForbiddenMatchInDialect(command, depth, 'posix');
+}
+function findForbiddenMatchInDialect(command, depth, dialect) {
     for (const rule of FORBIDDEN_RULES) {
-        if (rule.test(command))
+        if (rule.test(command, dialect))
             return rule.label;
     }
     // The same carriers the class scan reads, for the same reason. This list is the
@@ -1523,15 +1562,15 @@ export function findForbiddenMatch(command, depth = 0) {
     // `nestedCommands` regardless of this flag.
     if (depth >= MAX_NESTING_DEPTH)
         return null;
-    for (const inner of nestedCommands(command, false)) {
-        const match = findForbiddenMatch(inner, depth + 1);
+    for (const inner of nestedCommands(command, false, dialect)) {
+        const match = findForbiddenMatchInDialect(inner, depth + 1, dialect);
         if (match !== null)
             return match;
     }
     return null;
 }
-export function isForbidden(command) {
-    return findForbiddenMatch(command) !== null;
+export function isForbidden(command, dialect = 'posix') {
+    return findForbiddenMatchInDialect(command, 0, dialect) !== null;
 }
 /**
  * Commands that are destructive but legitimate under approval — e.g.
@@ -1548,9 +1587,9 @@ const DESTRUCTIVE_PATTERNS = [
  * reading a log that mentions `reboot` is no longer classified destructive
  * either.
  */
-function isDestructive(command) {
-    return (isForbidden(command) ||
-        matchesEitherForm(command, (form) => DESTRUCTIVE_PATTERNS.some((re) => re.test(form))));
+function isDestructive(command, dialect = 'posix') {
+    return (isForbidden(command, dialect) ||
+        matchesEitherForm(command, (form) => DESTRUCTIVE_PATTERNS.some((re) => re.test(form)), dialect));
 }
 const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*sudo\b/,
@@ -1558,13 +1597,13 @@ const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*doas\b/,
     /^\s*pkexec\b/,
 ];
-export function extractBinary(command) {
+export function extractBinary(command, dialect = 'posix') {
     // The first segment's words, so quoting is resolved — `s"u"do id` used to report
     // `s"u"do` in the audit record and the refusal message. Reading the normalised whole
     // command instead would be wrong in the other direction: it rejoins segments with
     // `; `, so `ls | grep x` would report `ls;`, and this name reaches the audit record,
     // the OTel span and OPA's input (#134). A separator is not a binary.
-    let cmd = (tokenizeSegments(command)[0] ?? []).join(' ').trim();
+    let cmd = (tokenizeSegments(command, dialect)[0] ?? []).join(' ').trim();
     for (const prefix of LEADING_PRIVILEGE_PREFIXES) {
         cmd = cmd.replace(prefix, '').trim();
     }
@@ -1910,8 +1949,8 @@ function awkFindings(words) {
  * `awk 'BEGIN{system("sudo id")}'` comes out `privileged` rather than flattened
  * to the `destructive` this function reports.
  */
-function hasDangerousAwk(command) {
-    for (const { words } of tokenizeSegmentsDetailed(command)) {
+function hasDangerousAwk(command, dialect = 'posix') {
+    for (const { words } of tokenizeSegmentsDetailed(command, true, dialect)) {
         const findings = awkFindings(words);
         if (findings === null)
             continue;
@@ -1923,15 +1962,15 @@ function hasDangerousAwk(command) {
         // prints into it, and that is assembled at run time. So it is the same
         // "we cannot tell" this module reports for `-f progfile`.
         for (const target of findings.pipedInto) {
-            const stage = tokenizeSegmentsDetailed(target)[0];
+            const stage = tokenizeSegmentsDetailed(target, true, dialect)[0];
             if (stage !== undefined && readsProgramFromStdin(stage.words))
                 return true;
         }
     }
     return false;
 }
-function hasUnreadableProgram(command) {
-    const segments = tokenizeSegmentsDetailed(command);
+function hasUnreadableProgram(command, dialect = 'posix') {
+    const segments = tokenizeSegmentsDetailed(command, true, dialect);
     for (let i = 0; i < segments.length; i++) {
         const { words, sep } = segments[i];
         if (sep === '|' && readsProgramFromStdin(words))
@@ -1971,8 +2010,8 @@ function hasUnreadableProgram(command) {
  * Only the command word, never the arguments. `echo $HOME` names a command we know;
  * promoting that would put a prompt on most ordinary shell usage.
  */
-function hasUnnameableCommand(command) {
-    for (const words of tokenizeSegments(command)) {
+function hasUnnameableCommand(command, dialect = 'posix') {
+    for (const words of tokenizeSegments(command, dialect)) {
         const head = effectiveCommandWord(words);
         if (head !== null && /[$`]/.test(head))
             return true;
@@ -2018,8 +2057,8 @@ const SYNTHETIC_CLASSES = Object.assign(Object.create(null), {
     'session:open': 'destructive',
 });
 /** The first word, tokenised — the synthetic verb when there is one. */
-function syntheticVerb(command) {
-    return tokenizeSegments(command)[0]?.[0] ?? '';
+function syntheticVerb(command, dialect = 'posix') {
+    return tokenizeSegments(command, dialect)[0]?.[0] ?? '';
 }
 /**
  * The class of a command, and of everything it carries.
@@ -2033,8 +2072,20 @@ function syntheticVerb(command) {
  * Taking the maximum is what makes the scan unable to lower anything.
  */
 export function classifyCommand(command, depth = 0) {
+    // One string, two dialects, and the class is the worse of the two readings:
+    // the classifier cannot know whether the host shell reads a backslash as an
+    // escape or as a path separator, so policy must hold on whichever host
+    // receives the command (GHSA-972x-g47g-3922). A command without a backslash
+    // is byte-identical under both dialects, so it keeps the single pass.
+    if (!command.includes('\\'))
+        return classifyCommandInDialect(command, depth, 'posix');
+    const posix = classifyCommandInDialect(command, depth, 'posix');
+    const windows = classifyCommandInDialect(command, depth, 'windows');
+    return CLASS_RANK[windows.class] > CLASS_RANK[posix.class] ? windows : posix;
+}
+function classifyCommandInDialect(command, depth, dialect) {
     const trimmed = command.trim();
-    const outer = classifyOuter(trimmed);
+    const outer = classifyOuter(trimmed, dialect);
     if (depth >= MAX_NESTING_DEPTH) {
         // Nesting this deep is not something an operator writes, and we have stopped
         // reading. Refusing to guess is the only answer consistent with the rest of this
@@ -2045,13 +2096,13 @@ export function classifyCommand(command, depth = 0) {
     // A floor, not a verdict. Returning the synthetic class outright would put it above
     // the elevation and never-allowed checks, so `sftp:upload /tmp/x; sudo id` would
     // record `destructive` where the command is `privileged`.
-    const verb = syntheticVerb(trimmed);
+    const verb = syntheticVerb(trimmed, dialect);
     const floor = SYNTHETIC_CLASSES[verb];
     if (floor !== undefined && CLASS_RANK[floor] > CLASS_RANK[highest.class]) {
         highest = { binary: verb, fullCommand: trimmed, class: floor };
     }
-    for (const inner of nestedCommands(trimmed)) {
-        const parsed = classifyCommand(inner, depth + 1);
+    for (const inner of nestedCommands(trimmed, true, dialect)) {
+        const parsed = classifyCommandInDialect(inner, depth + 1, dialect);
         // `binary` follows the winning side deliberately: it is what the audit record and
         // the refusal message name, and naming the outer `echo` would describe the wrong
         // process as the one that ran as root.
@@ -2073,18 +2124,18 @@ export function classifyCommand(command, depth = 0) {
     return result;
 }
 /** The class of the command itself, reading none of what it carries. */
-function classifyOuter(trimmed) {
-    const binary = extractBinary(trimmed);
+function classifyOuter(trimmed, dialect) {
+    const binary = extractBinary(trimmed, dialect);
     const fullCommand = trimmed;
     // `binary` names the subject of the class. For everything below it is the
     // leading command; here it is the one that runs as root, which are the same
     // thing only when the prefix leads.
-    const elevated = elevatedBinaryOf(trimmed);
+    const elevated = elevatedBinaryOf(trimmed, dialect);
     if (elevated !== null) {
         return { binary: elevated, fullCommand, class: 'privileged' };
     }
-    if (hasUnreadableProgram(trimmed) || hasDangerousAwk(trimmed)
-        || isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
+    if (hasUnreadableProgram(trimmed, dialect) || hasDangerousAwk(trimmed, dialect)
+        || isDestructive(trimmed, dialect) || hasDisqualifyingArgs(trimmed, dialect)) {
         return { binary, fullCommand, class: 'destructive' };
     }
     // Below this point every branch assumes the command word names something we
@@ -2095,10 +2146,10 @@ function classifyOuter(trimmed) {
     // `destructive` rather than `privileged`: this is "we cannot tell", not "this is
     // root". It gates on approval instead of refusing outright, which keeps
     // `$PREFIX/bin/tool` usable for a role that holds `destructive` on the tier.
-    if (hasUnnameableCommand(trimmed)) {
+    if (hasUnnameableCommand(trimmed, dialect)) {
         return { binary, fullCommand, class: 'destructive' };
     }
-    const words = tokenizeSegments(fullCommand)[0] ?? [];
+    const words = tokenizeSegments(fullCommand, dialect)[0] ?? [];
     const twoWordPrefix = words.slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)
         || READ_ONLY_SYNTHETIC.has(binary)) {
@@ -2125,7 +2176,7 @@ function classifyOuter(trimmed) {
         // no option or operand of the binary writes or executes, so extra
         // operands from an expansion are still data.
         if (entry.grammar.args !== 'any') {
-            const globWord = firstUnquotedGlobWord(fullCommand);
+            const globWord = firstUnquotedGlobWord(fullCommand, true, dialect);
             if (globWord !== null) {
                 return {
                     binary,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",