ssh-mcp 2.17.0 → 2.19.0

package/README.md

@@ -180,12 +180,13 @@ both and an auditor cannot tell which set of bytes landed. The digest is 128
 bits rather than a short prefix because that claim has to hold against a caller
 who picks both payloads, not only against an accidental repeat.
 
-The path comes last in that string on purpose. `[policy].denylist` patterns are
-matched against the whole approved string, so a rule anchored on the path —
-`authorized_keys$`, the natural way to write "nothing may write here" — keeps
-working. A rule anchored on the *whole* string (`^sftp:upload /root/.*$`) does
-not: it was coupled to a format that is ours to change, and this release changes
-it. Anchor on the path segment instead.
+`[policy].denylist` patterns are tested against that whole string and, for every
+SFTP tool, against the remote path on its own — as given, lexically normalized,
+and read the way Windows reads it (see "Policy Engine"). A rule written for the
+path, such as `authorized_keys$`, therefore does not depend on where the string
+puts it or on how the file is spelled. A rule anchored on the *whole* string
+(`^sftp:upload /root/.*$`) still does: that layout is ours to change, so anchor
+on the path instead.
 
 `sftp-upload-file` and `sftp-download-file` stream between the remote host and
 local disk instead. Neither the bytes nor a base64 encoding of them ever reaches
@@ -330,7 +331,7 @@ transferTimeoutMs = 60000           # per-profile override
 # operator on prod and leaves operator's other tiers, and viewer and admin,
 # on their defaults.
 [policy]
-denylist = ["^terraform\\s+destroy"]
+denylist = ["^terraform\\s+destroy", "\\.ssh/authorized_keys$"]
 
 [policy.roleBindings.operator]
 prod = ["read-only", "safe", "destructive"]
@@ -491,9 +492,52 @@ never-allowed list rather than replacing it:
 
 ```toml
 [policy]
-denylist = ["^terraform\\s+destroy"]
+denylist = ["^terraform\\s+destroy", "\\.ssh/authorized_keys$"]
 ```
 
+Each pattern is a regular expression tested against the command string of every
+call. For the five SFTP tools it is also tested against the remote path on its
+own, three ways: as given; in a normalized reading, where `//` and `/./`
+collapse, `..` resolves against the segment before it, a trailing `/` is
+dropped, and `\` is read as `/`; and in a **Windows reading**, tested
+case-insensitively. The refusal says which matched.
+
+The Windows reading is what Win32 resolves a path to, measured over SFTP on
+Windows 11 (build 26200): the case variants, a trailing run of dots and spaces,
+and the `::$DATA` default-stream spelling all reach the same file, so a rule
+that caught one spelling and not another was a bypass, not a distinction. On
+top of the normalized reading it strips those spellings, roots a
+drive-relative path (`C:x/…`) at its drive — where it actually resolves
+depends on process state this server cannot see, and rooting is the fail-closed
+reading — drops `\\?\` and `\\.\` device prefixes, and keeps a UNC root
+(`\\server\share\…` → `//server/share/…`). Tested case-insensitively, it also
+catches `Authorized_Keys` with a rule written for `authorized_keys`; on a POSIX
+target those are different files, but erring toward refusal is the direction
+this engine takes everywhere else too.
+
+What the readings do not do:
+
+- **resolve anything on the target.** A relative path stays relative, so a rule
+  anchored on `/root/` does not see `.ssh/authorized_keys`; symlinks are not
+  followed; and an 8.3 short name (`AUTHOR~1`) is not expanded — no lexical
+  reading can, it takes the target's own directory listing to know the long
+  name.
+- **test the local path** of `sftp-upload-file` or `sftp-download-file` on its
+  own. That side is confined by `transferRoot`. The local path does end those two
+  tools' command strings, so a pattern anchored on the end of the string can
+  still match it there, as it always could.
+
+So anchor a path rule on its trailing segments: `\.ssh/authorized_keys$` matches
+the absolute, relative and Windows spellings alike — including the case,
+trailing-dot and `::$DATA` variants of each. A pattern written for a command is
+tested against SFTP paths too — `^rm` refuses an `sftp-download` of a file
+called `rmlist.txt`.
+
+One performance note: patterns are ordinary regular expressions run against
+caller-supplied path bytes — bounded by the remote-path length limit, the same
+exposure the command string has always had. Prefer anchored, linear patterns; a
+catastrophically backtracking one stalls the tool call it matches.
+
 Because role and tier names are free strings, nothing in the merge itself can
 tell a new custom role from a misspelling of an existing one. A cross-check at
 startup does, and these all fail there rather than at the point of use:
@@ -551,9 +595,19 @@ there. ``), so the caller can see which spelling of the same command still works
 
 A separate **forbidden** list is never allowed, whatever the role or approval
 policy: `rm -rf /`, `mkfs`, `dd of=/dev/`, `shutdown`, `curl|sh`, fork bombs,
-writes to `/etc/cron`, `/etc/systemd` or `authorized_keys`, `iptables -F`, and
-recursive `chmod 777 /` / `chown /`. Add your own patterns via the policy
-denylist; an invalid pattern fails at startup rather than degrading silently.
+writes naming `/etc/cron`, `/etc/systemd` or any user's `authorized_keys`,
+`iptables -F`, and recursive `chmod 777 /` / `chown /`. A write *names* one of
+those paths when it is the remote path of an upload tool, the target of a shell
+redirect, or a destination of `tee`, `cp`, `mv`, `install` or `dd of=` — in any
+spelling the path readings above resolve. The two `/etc` families match by
+prefix, so `/etc/crontab` is covered along with everything under `/etc/cron.d`,
+and a sibling that merely starts like the directory (say `/etc/cronography`) is
+refused too — the fail-closed direction. Writes spelled any other way (`sed -i`,
+`rsync`, cmd.exe's `copy`, `move` and `robocopy`, a program handed to an
+interpreter, a path the target computes) are not on this list; class and approval
+govern them, and the operator denylist can close them. Add your own patterns via
+the policy denylist; an invalid pattern fails at
+startup rather than degrading silently.
 
 ### Approval Modes
 
@@ -633,7 +687,7 @@ during the outage, and the only signal is a stderr line MCP clients usually disc
 "opa-unavailable"` so the audit record says the gate was down rather than implying a policy
 refused the command.
 
-The request shape follows the AuthZEN Access Evaluation contract:
+The request shape is modeled on the AuthZEN Access Evaluation contract:
 
 ```json
 {
@@ -646,6 +700,19 @@ The request shape follows the AuthZEN Access Evaluation contract:
 }
 ```
 
+For the five SFTP tools, `resource` also carries three path keys: `remotePath`,
+the path as given; and `remotePathNormalized` and `remotePathWindows`, the same
+two readings the local denylist tests, so a rule can match a canonical spelling
+without parsing `command` or reimplementing either reading in Rego. The two
+upload tools add `remoteWrite: true`, the fact the local policy refuses the
+never-allowed write paths on — a rule can gate writes without parsing `command`
+either. Other tools omit all four, and so does an empty path. `remotePath` is **as given** —
+`/root//.ssh/x` arrives spelled that way, so a `startswith` rule on a directory
+misses it: match trailing segments, or match the normalized keys.
+`remotePathWindows` keeps the case it was given; `lower()` both sides in the
+policy for case-insensitive rules. Match fields rather than the whole
+`resource` object — its keys vary by tool.
+
 OPA responds with `{ "result": true/false }`. If OPA denies (`result: false`), the command is blocked even if the built-in engine allows it. If OPA is unreachable, the built-in engine's decision stands by default (fail-open, to avoid locking out access); `--opaFailClosed` refuses instead. A 200 that carries no boolean `result` counts as unreachable — that is what OPA answers for an undefined document, so a misnamed package or an unactivated bundle is an outage rather than consent.
 
 Example Rego policy (`ssh-mcp.rego`):

package/build/policy/classifier.js

@@ -1,5 +1,6 @@
 import { AWK_NAMES, readAwkInvocation } from './awk.js';
 import { matchesGrammar } from './reader-grammar.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 /**
  * Anything through which the shell can start a second command.
  *
@@ -588,7 +589,10 @@ const READ_ONLY_SYNTHETIC = new Set(['sftp:list', 'sftp:download']);
 /**
  * Commands that are never allowed, whatever the role or approval policy.
  *
- * This is the policy engine's denylist — the single definition of it. The
+ * This is the policy engine's denylist — the regex half of it. The word-based
+ * rules live below in FORBIDDEN_RULES, and the write-path families in
+ * never-allowed-writes.ts, which both the rules and the engine's resource
+ * check read. The
  * engine used to keep a parallel copy as regex *strings*, which had already
  * drifted (it was missing the fork bomb and the recursive chown, and its `rm`
  * pattern was narrower). Anything here is also destructive for classification
@@ -634,9 +638,6 @@ const FORBIDDEN_PATTERNS = [
     // against the target host rather than against this server, which is not worth either
     // trade — but it is a hole, not a closed door.
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
-    />\s*\/etc\/cron/,
-    />\s*\/etc\/systemd/,
-    />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
 ];
@@ -1483,9 +1484,20 @@ function pipesDownloadIntoShell(command, dialect = 'posix') {
         return false;
     return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
 }
-/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+/**
+ * `dd … of=/dev/sda` — writing an image straight onto a block device.
+ *
+ * Head via `effectiveCommandIndex`, not `parseSegments`: the privilege-prefix-only
+ * machine missed a wrapped `env dd of=/dev/sda` (measured in review) while the
+ * never-allowed write scan next door caught `env cp` — two dd readers two rules
+ * apart must not answer through different head-extraction machines.
+ */
 function writesToDevice(command, dialect = 'posix') {
-    return parseSegments(command, dialect).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+    return tokenizeSegments(command, dialect).some((words) => {
+        const idx = effectiveCommandIndex(words);
+        return idx !== -1 && stripPath(words[idx]) === 'dd'
+            && words.slice(idx + 1).some((a) => a.startsWith('of=/dev/'));
+    });
 }
 /**
  * `chown -R … /` — a recursive chown whose target is the filesystem root.
@@ -1501,6 +1513,309 @@ function chownsRoot(command, dialect = 'posix') {
         return positional[positional.length - 1] === '/';
     });
 }
+/**
+ * One dequoted word starting at `start`, as the redirect-target reader needs it.
+ *
+ * Stops at whitespace, at a character that begins another shell construct (`; | & < >
+ * ( )`), or at the end. Quotes are dropped and a closing quote does not end the
+ * word — the shell concatenates what follows it, so `> "/etc/cron.d"/x`,
+ * `> ""~/x` and `> a"b"c` all read as one target (the review round measured the
+ * `break`-on-close reading as a bypass: `> ""~/.ssh/authorized_keys` fell through).
+ * The quote/escape state machine is the same one `tokenizeSegmentsDetailed` runs
+ * (both keyed on DOUBLE_QUOTE_ESCAPABLE); a dialect fix must land in both loops.
+ */
+function readDequotedWord(command, start, dialect) {
+    const n = command.length;
+    if (start >= n || /[\s;&|<>()]/.test(command[start]))
+        return '';
+    let word = '';
+    let quote = command[start] === '"' || command[start] === "'" ? command[start] : null;
+    let escaped = false;
+    for (let i = quote === null ? start : start + 1; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            word += ch;
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\') {
+            if (quote === "'") {
+                word += ch;
+                continue;
+            }
+            if (quote === '"') {
+                const next = command[i + 1];
+                if (next === undefined || DOUBLE_QUOTE_ESCAPABLE.has(next)) {
+                    escaped = true;
+                    continue;
+                }
+                word += ch;
+                continue;
+            }
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+                continue;
+            }
+            word += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/[\s;&|<>()]/.test(ch))
+            break;
+        word += ch;
+    }
+    return word;
+}
+/**
+ * Every shell-redirect target in `command`, dequoted the way the shell will pass it.
+ *
+ * A redirect is an unquoted `>` — alone (`> f`), attached to the word it ends
+ * (`echo x>f`, which bash also reads as a redirect), doubled (`>>`), with an fd
+ * prefix (`2>`, `2>>`), with the both-streams spellings (`&>`, `&>>`, `>&`) or
+ * with the noclobber-override marker (`>|`). A `>` inside quotes is data
+ * (`echo "> f"` prints a string) and yields nothing, which is what separates this
+ * scan from the raw regexes it replaces: those fired on the quoted text too, so a
+ * commit message quoting a redirect was a refusal nobody could switch off
+ * (measured on main).
+ *
+ * The target is the next word after the operator, quoted or attached. An operator
+ * with nothing readable after it is a syntax error the remote shell would report,
+ * and yields nothing. `>(...)` process substitution yields nothing here too — its
+ * inner command is a carrier `nestedCommands` already reads.
+ */
+function redirectTargets(command, dialect) {
+    const targets = [];
+    const n = command.length;
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\' && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch !== '>' && !(ch === '&' && command[i + 1] === '>'))
+            continue;
+        let j = ch === '&' ? i + 2 : i + 1;
+        if (command[j] === '>')
+            j++; // >>
+        if (command[j] === '&')
+            j++; // >& fd duplication
+        if (command[j] === '|')
+            j++; // >| noclobber override
+        while (j < n && /\s/.test(command[j]))
+            j++;
+        const word = readDequotedWord(command, j, dialect);
+        if (word !== '')
+            targets.push(word);
+        i = j - 1;
+    }
+    return targets;
+}
+/**
+ * xargs's own value-taking flags — one tool's option set, enumerable the way
+ * `PREFIX_VALUE_FLAGS` holds sudo's. `effectiveCommandIndex` steps a wrapper's
+ * flags with *sudo's* set, so `xargs -I {}` leaves `{}` looking like the command
+ * and the verb xargs really runs hides behind it (measured in review:
+ * `xargs -I {} cp {} /root/.ssh/authorized_keys` passed).
+ */
+const XARGS_VALUE_FLAGS = new Set(['-I', '-J', '-d', '-E', '-n', '-s', '-P', '-R', '-L', '-S']);
+/**
+ * The command index for a segment whose wrapper may be `xargs`, which the plain
+ * `effectiveCommandIndex` cannot step past. Same walk, one addition; runs
+ * alongside the plain index so nothing else changes.
+ */
+function indexPastXargsFlags(words) {
+    let i = 0;
+    while (i < words.length) {
+        const raw = words[i];
+        const word = stripPath(unquote(raw));
+        if (word === 'xargs') {
+            i++;
+            while (i < words.length && words[i].startsWith('-')) {
+                const consumesValue = XARGS_VALUE_FLAGS.has(words[i]);
+                i++;
+                if (consumesValue)
+                    i++;
+            }
+            continue;
+        }
+        if (PRIVILEGE_PREFIXES.has(word) || EXEC_WRAPPERS.has(word)) {
+            i++;
+            continue;
+        }
+        if (ASSIGNMENT.test(raw) || raw.startsWith('-') || BARE_NUMERIC.test(raw)) {
+            i++;
+            continue;
+        }
+        return i;
+    }
+    return -1;
+}
+/**
+ * The positional operands of the copy family, with every option spelling that
+ * carries a value stepped over.
+ *
+ * GNU getopt permutes options anywhere in the argv — `install k
+ * /root/.ssh/authorized_keys -m 600` is ordinary usage — so a value-taking flag
+ * trailing the destination must not have its value read as the last positional
+ * (measured in review: it displaced the destination and the write was missed).
+ * `-t`/`--target-directory` in all three spellings (`-t DIR`, `-tDIR`,
+ * `--target-directory=DIR`, `--target-directory DIR`) is stepped here too; the
+ * caller reads its value as the destination itself.
+ */
+function copyPositionals(args) {
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '-t' || arg === '--target-directory') {
+            i++;
+            continue;
+        }
+        if (/^-t.+/.test(arg) || /^--target-directory=/.test(arg))
+            continue;
+        // An attached short value (`-m600`) needs no line of its own: the generic
+        // `-` skip below already keeps it out of the positionals.
+        if (arg === '-m' || arg === '-o' || arg === '-g' || arg === '-S' || arg === '-Z') {
+            i++;
+            continue;
+        }
+        if (/^--(mode|owner|group|suffix|context|sparse)=/.test(arg))
+            continue;
+        if (arg === '--mode' || arg === '--owner' || arg === '--group' || arg === '--suffix'
+            || arg === '--context' || arg === '--sparse') {
+            i++;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        positional.push(arg);
+    }
+    return positional;
+}
+/**
+ * The destination operands of the verbs whose argv names the file they write.
+ *
+ * A closed list, on purpose. `tee` writes every non-flag operand; `cp`, `mv` and
+ * `install` write their destination operand — the value of `-t`/
+ * `--target-directory` in any of its spellings when present, else the last
+ * positional — and, because that operand may name a directory the sources are
+ * copied *into*, the same joined with each source's basename, so `cp
+ * authorized_keys ~/.ssh/` is caught rather than only `cp k
+ * ~/.ssh/authorized_keys`. `install -d` creates every operand. `dd of=` writes
+ * the value. Every other verb is a documented residual: a guess about an
+ * unrecognised binary's operands must not reach this list (the
+ * `speculativeOperands: false` ruling), and #230's decision 1 already ruled that
+ * extracting paths from shell text can never be complete — so the README lists
+ * these forms and names the rest as governed by class and approval instead.
+ *
+ * `env cp …`, `sudo cp …`, `timeout 5 cp …` and `xargs -I {} cp …` reach the
+ * verb through `effectiveCommandIndex` and its xargs-stepping sibling.
+ */
+function writeVerbTargets(command, dialect) {
+    const targets = [];
+    for (const words of tokenizeSegments(command, dialect)) {
+        const heads = [effectiveCommandIndex(words), indexPastXargsFlags(words)]
+            .filter((i, idx, all) => i !== -1 && all.indexOf(i) === idx);
+        for (const idx of heads) {
+            const head = stripPath(words[idx]);
+            const args = words.slice(idx + 1);
+            if (head === 'tee') {
+                targets.push(...args.filter((a) => !a.startsWith('-')));
+                continue;
+            }
+            if (head === 'dd') {
+                for (const arg of args) {
+                    if (arg.startsWith('of='))
+                        targets.push(arg.slice(3));
+                }
+                continue;
+            }
+            if (head === 'cp' || head === 'mv' || head === 'install') {
+                const positional = copyPositionals(args);
+                if (head === 'install' && args.some((a) => a === '-d' || a === '--directory')) {
+                    targets.push(...positional);
+                    continue;
+                }
+                const tIndex = args.findIndex((a) => a === '-t' || a === '--target-directory'
+                    || /^-t.+/.test(a) || a.startsWith('--target-directory='));
+                let dest = null;
+                let sources = positional;
+                if (tIndex !== -1) {
+                    const flag = args[tIndex];
+                    if (flag === '-t' || flag === '--target-directory') {
+                        dest = args[tIndex + 1] || null;
+                    }
+                    else {
+                        const eq = flag.indexOf('=');
+                        dest = eq === -1 ? flag.slice(2) : flag.slice(eq + 1);
+                    }
+                }
+                else if (positional.length >= 2) {
+                    dest = positional[positional.length - 1];
+                    sources = positional.slice(0, -1);
+                }
+                if (dest === null || dest === '')
+                    continue;
+                targets.push(dest);
+                for (const src of sources) {
+                    const base = stripPath(src);
+                    if (base !== '')
+                        targets.push(`${dest}/${base}`);
+                }
+            }
+        }
+    }
+    return targets;
+}
+/**
+ * The never-allowed family cache — same shape and reason as `normalizedCache`:
+ * three ForbiddenRule entries ask the same (command, dialect) question in a row,
+ * and each ask re-ran both scans over the whole command. Keyed with the dialect
+ * because both readings of one command are asked in the same row.
+ */
+const neverAllowedWriteCache = new Map();
+/**
+ * Which never-allowed family this command's certain write forms name, or null.
+ * Both dialects are tried by the caller (findForbiddenMatchInDialect), and nested
+ * commands reach this through the same recursion every other rule uses.
+ */
+function findNeverAllowedWriteFamily(command, dialect) {
+    const key = `${dialect}\u0000${command}`;
+    if (neverAllowedWriteCache.has(key))
+        return neverAllowedWriteCache.get(key);
+    let family = null;
+    for (const candidate of [...redirectTargets(command, dialect), ...writeVerbTargets(command, dialect)]) {
+        family = findNeverAllowedWriteTarget(candidate);
+        if (family !== null)
+            break;
+    }
+    neverAllowedWriteCache.set(key, family);
+    if (neverAllowedWriteCache.size > 8) {
+        neverAllowedWriteCache.delete(neverAllowedWriteCache.keys().next().value);
+    }
+    return family;
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({
         label: String(re),
@@ -1516,6 +1831,10 @@ const FORBIDDEN_RULES = [
     },
     { label: 'dd writing to a block device (of=/dev/…)', test: (c, dialect) => writesToDevice(c, dialect) },
     { label: 'a recursive chown of the filesystem root', test: (c, dialect) => chownsRoot(c, dialect) },
+    ...['/etc/cron', '/etc/systemd', 'authorized_keys'].map((family) => ({
+        label: neverAllowedWriteLabel(family),
+        test: (command, dialect) => findNeverAllowedWriteFamily(command, dialect) === family,
+    })),
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:

package/build/policy/engine.js

@@ -1,5 +1,9 @@
 import { classifyCommand, findForbiddenMatch, formatReadOnlyRejection } from './classifier.js';
+import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 import { OperatorError } from '../errors.js';
+/** The operator-facing promise every built-in never-allowed refusal ends with. */
+const NEVER_ALLOWED_TRAILER = 'This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.';
 /**
  * How long to wait for the OPA sidecar before treating it as unavailable.
  *
@@ -200,7 +204,11 @@ export class PolicyEngine {
     opaTimeoutMs = DEFAULT_OPA_TIMEOUT_MS;
     /** Rate-limits the fail-open warning so one outage can't flood stderr. */
     lastOpaWarning = 0;
-    /** The operator's patterns, compiled once. The built-ins live in classifier.ts. */
+    /**
+     * The operator's patterns, compiled once — each twice: as written, and
+     * case-insensitively for the Windows reading of a remote path, where a
+     * case variant reaches the same file (#230). The built-ins live in classifier.ts.
+     */
     userPatterns;
     constructor(rules = DEFAULT_RULES) {
         this.rules = rules;
@@ -209,7 +217,7 @@ export class PolicyEngine {
         // worse than a startup failure, because nothing surfaces the degradation.
         this.userPatterns = (rules.denylist ?? []).map((pattern) => {
             try {
-                return new RegExp(pattern);
+                return { exact: new RegExp(pattern), caseInsensitive: new RegExp(pattern, 'i') };
             }
             catch (err) {
                 throw new OperatorError(`Invalid denylist pattern ${JSON.stringify(pattern)}: ${err instanceof Error ? err.message : String(err)}`);
@@ -226,7 +234,7 @@ export class PolicyEngine {
         this.opaUrl = url;
         this.opaFailClosed = failClosed;
     }
-    evaluate(command, profile, _toolName) {
+    evaluate(command, profile, resource = {}) {
         const parsed = classifyCommand(command);
         const allowedClasses = this.getAllowedClasses(profile);
         const classAllowed = allowedClasses.includes(parsed.class);
@@ -235,7 +243,7 @@ export class PolicyEngine {
         // since a grammar-rejected reader is allowed as `safe` for most roles and
         // only refused one layer up, in the tool itself.
         const readOnlyRejection = parsed.readOnlyRejection;
-        const denied = this.findDenyMatch(command);
+        const denied = this.findDenyMatch(command, resource);
         if (denied) {
             return {
                 decision: 'deny',
@@ -288,8 +296,8 @@ export class PolicyEngine {
             readOnlyRejection,
         };
     }
-    async evaluateWithOpa(command, profile, toolName) {
-        const local = this.evaluate(command, profile, toolName);
+    async evaluateWithOpa(command, profile, toolName, resource = {}) {
+        const local = this.evaluate(command, profile, resource);
         if (local.decision === 'deny') {
             return local;
         }
@@ -298,10 +306,23 @@ export class PolicyEngine {
         }
         try {
             const parsed = classifyCommand(command);
+            // The path as given, plus both readings the local denylist tests, so a Rego rule
+            // can match a canonical spelling without reimplementing either here. Undefined for
+            // every tool but the SFTP ones — and for an empty path, which means no path — and
+            // JSON drops the keys then.
+            const remotePath = resource.remotePath || undefined;
             const input = {
                 subject: { role: profile.role, profile: profile.name },
                 action: { tool: toolName, commandClass: parsed.class },
-                resource: { command: parsed.fullCommand, binary: parsed.binary, host: profile.host },
+                resource: {
+                    command: parsed.fullCommand,
+                    binary: parsed.binary,
+                    host: profile.host,
+                    remotePath,
+                    remoteWrite: resource.remoteWrite || undefined,
+                    remotePathNormalized: remotePath === undefined ? undefined : normalizeRemotePath(remotePath),
+                    remotePathWindows: remotePath === undefined ? undefined : normalizeRemotePathForWindows(remotePath),
+                },
                 context: { readOnly: profile.readOnly },
             };
             const resp = await fetch(`${this.opaUrl}/v1/data/ssh/mcp/allow`, {
@@ -485,18 +506,65 @@ export class PolicyEngine {
      * group, the class and the allowed set; this path never got the same
      * treatment.
      */
-    findDenyMatch(command) {
+    findDenyMatch(command, resource) {
         const builtIn = findForbiddenMatch(command);
         if (builtIn) {
-            return `Command matches a built-in never-allowed rule: ${builtIn}. ` +
-                `This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.`;
+            return `Command matches a built-in never-allowed rule: ${builtIn}. ${NEVER_ALLOWED_TRAILER}`;
         }
-        for (const pattern of this.userPatterns) {
-            if (pattern.test(command)) {
-                return `Command matches /${pattern.source}/, a pattern from [policy].denylist in your config file. ` +
-                    `Remove or narrow it there to allow this command.`;
+        // The built-in never-allowed write paths, tested against a remote path the tool
+        // declared it writes. Runs before the early return below because the defaults
+        // carry no operator denylist — this check is not the operator's to switch on.
+        if (resource.remoteWrite && resource.remotePath) {
+            const target = findNeverAllowedWriteTarget(resource.remotePath);
+            if (target !== null) {
+                return `Remote path ${quotePath(resource.remotePath)} matches a built-in never-allowed rule: ` +
+                    `${neverAllowedWriteLabel(target)}. ${NEVER_ALLOWED_TRAILER}`;
+            }
+        }
+        // Nothing below can match: skip reading the path at all, which is the commonest
+        // config — the defaults carry no denylist.
+        if (this.userPatterns.length === 0)
+            return null;
+        // The path is tested on its own as well as inside the command string, because for the
+        // SFTP tools that string is ours to lay out and a rule written for the path should not
+        // depend on where we put it (#230). An empty path means none was passed.
+        const remotePath = resource.remotePath || undefined;
+        const normalized = remotePath === undefined ? undefined : normalizeRemotePath(remotePath);
+        const windows = remotePath === undefined ? undefined : normalizeRemotePathForWindows(remotePath);
+        const fromConfig = 'a pattern from [policy].denylist in your config file. ' +
+            'Remove or narrow it there to allow this command.';
+        for (const { exact, caseInsensitive } of this.userPatterns) {
+            if (exact.test(command)) {
+                return `Command matches /${exact.source}/, ${fromConfig}`;
+            }
+            if (remotePath === undefined)
+                continue;
+            if (exact.test(remotePath)) {
+                return `Remote path ${quotePath(remotePath)} matches /${exact.source}/, ${fromConfig}`;
+            }
+            if (normalized !== remotePath && exact.test(normalized)) {
+                return `Remote path ${quotePath(remotePath)} (read as ${quotePath(normalized)}) ` +
+                    `matches /${exact.source}/, ${fromConfig}`;
+            }
+            // The Windows reading runs even when it string-equals the plain one, because the
+            // pattern is tested case-insensitively here and exactly above: on Windows the case
+            // variants are the same file (measured, see remote-path.ts).
+            if (caseInsensitive.test(windows)) {
+                return `Remote path ${quotePath(remotePath)} (read as ${quotePath(windows)}, the Windows reading) ` +
+                    `matches /${caseInsensitive.source}/i, ${fromConfig}`;
             }
         }
         return null;
     }
 }
+/**
+ * A path as it may appear in a refusal, capped. The paths are caller-supplied and can be
+ * as long as `MAX_REMOTE_PATH_CHARS` (4096); the refusal is rethrown to the MCP client
+ * and written into the audit record, where the command string already carries the full
+ * spelling — so the tail gives up nothing an operator needs, and a refusal stops being
+ * the engine's most verbose sentence by an order of magnitude.
+ */
+function quotePath(path) {
+    const capped = path.length > 256 ? `${path.slice(0, 253)}…` : path;
+    return JSON.stringify(capped);
+}

package/build/policy/never-allowed-writes.js

@@ -0,0 +1,51 @@
+import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+/**
+ * The `/etc` families are prefix matches with no boundary: `/etc/crontab` sits under
+ * `/etc/cron` the same way `/etc/cron.d/x` does, which is how the redirect regex this
+ * module replaces always read it. A sibling that merely starts like the directory
+ * (`/etc/cronography`) fires too — over-refusal in the fail-closed direction this
+ * engine takes everywhere else.
+ */
+const NEVER_DIRS = ['/etc/cron', '/etc/systemd'];
+/** The keys family: any path whose last two segments are `.ssh/authorized_keys`. */
+const KEYS_TAIL = '/.ssh/authorized_keys';
+/**
+ * The refusal wording for a family, defined once because two check sites quote it:
+ * the classifier's ForbiddenRule label and the engine's built-in deny reason.
+ */
+export function neverAllowedWriteLabel(target) {
+    switch (target) {
+        case '/etc/cron': return 'writing to /etc/cron';
+        case '/etc/systemd': return 'writing to /etc/systemd';
+        case 'authorized_keys': return "writing to any user's authorized_keys";
+    }
+}
+function familyOf(path) {
+    for (const dir of NEVER_DIRS) {
+        if (path.startsWith(dir))
+            return dir;
+    }
+    if (path.endsWith(KEYS_TAIL) || path === KEYS_TAIL.slice(1))
+        return 'authorized_keys';
+    return null;
+}
+/**
+ * Whether `path` names one of the never-allowed write targets, in any spelling the
+ * path readings resolve.
+ *
+ * The same three readings `[policy].denylist` sees (#230): the path as given; a
+ * lexically normalized reading (`//`, `/./`, `..`, trailing separators, `\` as a
+ * separator); and the Windows reading of it, case-insensitively — so `Authorized_Keys.`,
+ * `authorized_keys::$DATA` and backslash spellings reach the same refusal. On a POSIX
+ * target some of those are different files; refusing them is the safe direction, the
+ * same trade the operator denylist already makes.
+ *
+ * What this does not do is resolve anything on the target: a relative path stays
+ * relative, symlinks are not followed, and an 8.3 short name is not expanded (#230's
+ * documented residuals, inherited here).
+ */
+export function findNeverAllowedWriteTarget(path) {
+    return familyOf(path)
+        ?? familyOf(normalizeRemotePath(path))
+        ?? familyOf(normalizeRemotePathForWindows(path).toLowerCase());
+}

package/build/policy/remote-path.js

@@ -0,0 +1,125 @@
+/**
+ * A remote path as a `[policy].denylist` pattern should also see it (#230).
+ *
+ * Lexical only: nothing is asked of the target, so a relative path stays relative and a
+ * symlink is not followed. What it removes is the spelling that keeps a rule from seeing
+ * a path it was written for — `//`, `/./`, `..`, a trailing separator — and it reads `\`
+ * as a separator too, so a Windows target's `C:\Users\a\.ssh\authorized_keys` is also
+ * seen as `C:/Users/a/.ssh/authorized_keys`. On a POSIX target a filename containing `\`
+ * can then match where it did not before; that only ever widens a refusal.
+ *
+ * An absolute path — `/…`, or one starting with a drive letter — cannot climb above its
+ * root. A relative path keeps a leading `..` it has nothing to resolve against.
+ *
+ * Not `node:path`: `posix.normalize` lets `..` climb above a drive root (`C:/../x` →
+ * `x`) and keeps a trailing separator, and `win32.normalize` answers in backslashes —
+ * while a deny rule needs one reading, in forward slashes, that never climbs.
+ */
+const DRIVE_LETTER = /^[A-Za-z]:$/;
+export function normalizeRemotePath(path) {
+    const segments = path.replace(/\\/g, '/').split('/');
+    let root = null;
+    if (segments[0] === '') {
+        root = '';
+        segments.shift();
+    }
+    else if (DRIVE_LETTER.test(segments[0])) {
+        root = segments.shift();
+    }
+    const kept = [];
+    for (const segment of segments) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..') {
+            if (kept.length > 0 && kept[kept.length - 1] !== '..')
+                kept.pop();
+            else if (root === null)
+                kept.push('..');
+            continue;
+        }
+        kept.push(segment);
+    }
+    if (root === null)
+        return kept.length > 0 ? kept.join('/') : '.';
+    if (root === '')
+        return kept.length > 0 ? `/${kept.join('/')}` : '/';
+    return kept.length > 0 ? `${root}/${kept.join('/')}` : `${root}/`;
+}
+/**
+ * The same path as Win32 would resolve it, for a denylist that must not depend on how
+ * the caller spelled the file (#230).
+ *
+ * Every transformation here was measured over SFTP on the Windows test VM (Windows 11
+ * build 26200): the spellings below reached the same file as the canonical one, so a
+ * rule that caught one spelling and not the other was a bypass, not a distinction.
+ *
+ * - `\` is read as `/`, as above.
+ * - A trailing run of dots and spaces is dropped from every segment (`authorized_keys.`
+ *   and `authorized_keys..` are the same file). A segment that is nothing but dots
+ *   (`a.../b`) therefore disappears, the way Win32 reads it.
+ * - A `::` suffix is cut (`authorized_keys::$DATA` is the file's default stream, not a
+ *   different file). A single `:` is left alone: that names a different stream, and the
+ *   measurement showed it does not reach the same bytes.
+ * - A drive-relative spelling (`C:x/…`, resolved against the drive's current directory
+ *   on Windows) is rooted at the drive. Where it actually resolves depends on process
+ *   state this server cannot see; rooting is the fail-closed reading.
+ * - `\\?\` and `\\.\` device prefixes are dropped. SFTP itself rejects them, but a rule
+ *   should not have to know that.
+ * - A UNC spelling keeps its root (`\\server\share\…` → `//server/share/…`), which the
+ *   plain reading collapses; `..` cannot climb above the share.
+ *
+ * Case is deliberately untouched — the engine tests this reading case-insensitively,
+ * which also covers a case-variant spelling of an otherwise identical path.
+ *
+ * Two Windows equivalences remain outside any lexical reading, because resolving them
+ * needs the target's own directory state, and are documented residuals in the README:
+ * 8.3 short names (`AUTHOR~1`), and symlinks.
+ *
+ * On a POSIX target these readings can only widen a refusal: a file genuinely named
+ * `authorized_keys.` is a different file there, but refusing it is the safe direction,
+ * exactly as with `\` above.
+ */
+export function normalizeRemotePathForWindows(path) {
+    let slashed = path.replace(/\\/g, '/');
+    if (slashed.startsWith('//?/') || slashed.startsWith('//./'))
+        slashed = slashed.slice(4);
+    const segments = slashed.split('/');
+    let root = null;
+    let rest = segments;
+    if (segments[0] === '' && segments[1] === '') {
+        // A UNC root: the share is as high as `..` may climb.
+        root = `//${segments[2] ?? ''}/${segments[3] ?? ''}`;
+        rest = segments.slice(4);
+    }
+    else if (segments[0] === '') {
+        root = '/';
+        rest = segments.slice(1);
+    }
+    else if (/^[A-Za-z]:/.test(segments[0])) {
+        const drive = segments[0].slice(0, 2);
+        const after = segments[0].slice(2);
+        root = drive;
+        rest = after === '' ? segments.slice(1) : [after, ...segments.slice(1)];
+    }
+    const kept = [];
+    for (const segment of rest) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..') {
+            if (kept.length > 0 && kept[kept.length - 1] !== '..')
+                kept.pop();
+            else if (root === null)
+                kept.push('..');
+            continue;
+        }
+        const plain = segment.split('::')[0].replace(/[ .]+$/, '');
+        if (plain === '')
+            continue;
+        kept.push(plain);
+    }
+    if (root === null)
+        return kept.length > 0 ? kept.join('/') : '.';
+    if (root === '/')
+        return kept.length > 0 ? `/${kept.join('/')}` : '/';
+    return kept.length > 0 ? `${root}/${kept.join('/')}` : `${root}/`;
+}

package/build/tools/command-tools.js

@@ -54,7 +54,7 @@ export function registerCommandTools({ server, registry, policy }, pipeline) {
                 // `registry.getProfile()`, which refuses on an unconfigured server, and outside
                 // the pipeline's try that refusal escaped without an audit record. `preCheck`
                 // runs inside it.
-                const rawEval = policy.evaluate(cleanCmd, registry.getProfile(defaultProfileName(profile)), 'privileged-command');
+                const rawEval = policy.evaluate(cleanCmd, registry.getProfile(defaultProfileName(profile)));
                 if (rawEval.decision === 'deny') {
                     throw new PolicyRefusedError(`POLICY_DENIED: ${rawEval.reason || 'Command not allowed'}`, rawEval);
                 }

package/build/tools/file-tools.js

@@ -42,23 +42,18 @@ export function registerFileTools({ server }, pipeline) {
         profile: z.string().optional().describe('Profile name'),
     }, { destructiveHint: true }, async ({ remotePath, content, profile }, extra) => {
         return runAudited(
-        // Verb, then what the operation does, then the path it does it to — and the
-        // path LAST on purpose. The engine matches `[policy].denylist` against this
-        // whole string, so an operator rule anchored on the path (`authorized_keys$`,
-        // the natural and portable way to write "nothing may write here") keeps
-        // working only while the path ends the line. Measured: with the suffixes
-        // appended after the path instead, that rule silently stops matching and the
-        // refusal degrades to a prompt with no warning. A whole-string rule
-        // (`^sftp:upload /root.*$`) breaks either way — it is coupled to a format
-        // that is ours to change — so the layout is chosen for the form that is not.
-        // `sftp:list` and `sftp:download` carry no flags, so they already read this
-        // way and need no change.
+        // Verb, then what the operation does, then the path it does it to. The path
+        // ends the line so the string reads naturally in a prompt and an audit record;
+        // `[policy].denylist` no longer depends on that, since every SFTP tool hands
+        // its remote path to the engine on its own (#230). A rule anchored on the whole
+        // string (`^sftp:upload /root.*$`) is still coupled to this layout.
         `sftp:upload${OVERWRITE_FLAG}${payloadSuffix(content)} ${remotePathForAudit(remotePath)}`, {
             toolName: 'sftp-upload',
             failureClass: 'destructive',
             profile,
             extra,
             synthetic: true,
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             await new SftpClient(rt.conn).upload({ remotePath, content });
@@ -81,6 +76,7 @@ export function registerFileTools({ server }, pipeline) {
             profile,
             extra,
             synthetic: true,
+            resource: { remotePath },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             const data = await new SftpClient(rt.conn).download({ remotePath });

package/build/tools/pipeline.js

@@ -35,13 +35,13 @@ export function createPipeline({ server, registry, policy, audit, approvalGrantT
     async function resolveConn(profileName) {
         return registry.getOrCreate(profileName);
     }
-    async function checkPolicyAndApprove(command, profileName, toolName) {
+    async function checkPolicyAndApprove(command, profileName, toolName, resource = {}) {
         const span = tracer.startSpan('policy.evaluate');
         span.setAttribute('tool.name', toolName);
         span.setAttribute('ssh.profile', profileName);
         try {
             const conn = await resolveConn(profileName);
-            const evaluation = await policy.evaluateWithOpa(command, conn.profile, toolName);
+            const evaluation = await policy.evaluateWithOpa(command, conn.profile, toolName, resource);
             span.setAttribute('policy.decision', evaluation.decision);
             span.setAttribute('command.class', evaluation.commandClass);
             span.setAttribute('command.binary', evaluation.binary);
@@ -167,7 +167,7 @@ export function createPipeline({ server, registry, policy, audit, approvalGrantT
                 effective = opts.wrap(effective);
                 state.command = effective;
             }
-            const { conn, evaluation, approver } = await checkPolicyAndApprove(effective, profileName, opts.toolName);
+            const { conn, evaluation, approver } = await checkPolicyAndApprove(effective, profileName, opts.toolName, opts.resource);
             state.evaluation = evaluation;
             if (opts.enforceClass && evaluation.commandClass !== opts.enforceClass) {
                 // A command that fell to `safe` because a reader's grammar rejected one

package/build/tools/transfer-tools.js

@@ -207,6 +207,7 @@ export function registerTransferTools({ server, localPath }, pipeline) {
             profile,
             extra,
             synthetic: true,
+            resource: { remotePath },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             const budget = rt.conn.profile.maxOutputBytes;
@@ -255,6 +256,7 @@ export function registerTransferTools({ server, localPath }, pipeline) {
             profile,
             extra,
             synthetic: true,
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); checkMode(mode); },
         }, async (rt) => {
             const maxBytes = rt.conn.profile.transferMaxBytes;
@@ -306,6 +308,7 @@ export function registerTransferTools({ server, localPath }, pipeline) {
             profile,
             extra,
             synthetic: true,
+            resource: { remotePath },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             // As on the upload side, and for the same reason: refined before the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.17.0",
+  "version": "2.19.0",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",