ssh-mcp 2.18.0 → 2.19.1

package/README.md

@@ -593,11 +593,29 @@ read-only only with the options and operands its grammar lists; `--foo` is not a
 there. ``), so the caller can see which spelling of the same command still works. See
 [SECURITY.md](./SECURITY.md) for the residual risks this leaves open.
 
+A reader also falls to `safe` when its command carries a shell metacharacter — `;` `&` `|`
+`<` `>` `` ` `` `$` `(` `)` `{` `}`, a newline or a carriage return — quoted or not, because
+the allowlist vouches for the binary, never for what a shell might do with the rest of the
+line. The refusal names the first such character. For `sftp-list` and `sftp-download` it is
+in the remote path, so `/srv/backup(old)` is refused for a `readOnly` profile with
+`` The remote path contains `(`, which counts as a shell metacharacter here, so `sftp:list`
+is read-only only for a path without one. ``
+
 A separate **forbidden** list is never allowed, whatever the role or approval
 policy: `rm -rf /`, `mkfs`, `dd of=/dev/`, `shutdown`, `curl|sh`, fork bombs,
-writes to `/etc/cron`, `/etc/systemd` or `authorized_keys`, `iptables -F`, and
-recursive `chmod 777 /` / `chown /`. Add your own patterns via the policy
-denylist; an invalid pattern fails at startup rather than degrading silently.
+writes naming `/etc/cron`, `/etc/systemd` or any user's `authorized_keys`,
+`iptables -F`, and recursive `chmod 777 /` / `chown /`. A write *names* one of
+those paths when it is the remote path of an upload tool, the target of a shell
+redirect, or a destination of `tee`, `cp`, `mv`, `install` or `dd of=` — in any
+spelling the path readings above resolve. The two `/etc` families match by
+prefix, so `/etc/crontab` is covered along with everything under `/etc/cron.d`,
+and a sibling that merely starts like the directory (say `/etc/cronography`) is
+refused too — the fail-closed direction. Writes spelled any other way (`sed -i`,
+`rsync`, cmd.exe's `copy`, `move` and `robocopy`, a program handed to an
+interpreter, a path the target computes) are not on this list; class and approval
+govern them, and the operator denylist can close them. Add your own patterns via
+the policy denylist; an invalid pattern fails at
+startup rather than degrading silently.
 
 ### Approval Modes
 
@@ -693,8 +711,10 @@ The request shape is modeled on the AuthZEN Access Evaluation contract:
 For the five SFTP tools, `resource` also carries three path keys: `remotePath`,
 the path as given; and `remotePathNormalized` and `remotePathWindows`, the same
 two readings the local denylist tests, so a rule can match a canonical spelling
-without parsing `command` or reimplementing either reading in Rego. Other tools
-omit all three, and so does an empty path. `remotePath` is **as given** —
+without parsing `command` or reimplementing either reading in Rego. The two
+upload tools add `remoteWrite: true`, the fact the local policy refuses the
+never-allowed write paths on — a rule can gate writes without parsing `command`
+either. Other tools omit all four, and so does an empty path. `remotePath` is **as given** —
 `/root//.ssh/x` arrives spelled that way, so a `startswith` rule on a directory
 misses it: match trailing segments, or match the normalized keys.
 `remotePathWindows` keeps the case it was given; `lower()` both sides in the

package/build/policy/classifier.js

@@ -1,5 +1,6 @@
 import { AWK_NAMES, readAwkInvocation } from './awk.js';
 import { matchesGrammar } from './reader-grammar.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 /**
  * Anything through which the shell can start a second command.
  *
@@ -588,7 +589,10 @@ const READ_ONLY_SYNTHETIC = new Set(['sftp:list', 'sftp:download']);
 /**
  * Commands that are never allowed, whatever the role or approval policy.
  *
- * This is the policy engine's denylist — the single definition of it. The
+ * This is the policy engine's denylist — the regex half of it. The word-based
+ * rules live below in FORBIDDEN_RULES, and the write-path families in
+ * never-allowed-writes.ts, which both the rules and the engine's resource
+ * check read. The
  * engine used to keep a parallel copy as regex *strings*, which had already
  * drifted (it was missing the fork bomb and the recursive chown, and its `rm`
  * pattern was narrower). Anything here is also destructive for classification
@@ -634,9 +638,6 @@ const FORBIDDEN_PATTERNS = [
     // against the target host rather than against this server, which is not worth either
     // trade — but it is a hole, not a closed door.
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
-    />\s*\/etc\/cron/,
-    />\s*\/etc\/systemd/,
-    />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
 ];
@@ -1483,9 +1484,20 @@ function pipesDownloadIntoShell(command, dialect = 'posix') {
         return false;
     return heads.slice(firstDownload + 1).some((h) => h !== undefined && SHELLS.has(h));
 }
-/** `dd … of=/dev/sda` — writing an image straight onto a block device. */
+/**
+ * `dd … of=/dev/sda` — writing an image straight onto a block device.
+ *
+ * Head via `effectiveCommandIndex`, not `parseSegments`: the privilege-prefix-only
+ * machine missed a wrapped `env dd of=/dev/sda` (measured in review) while the
+ * never-allowed write scan next door caught `env cp` — two dd readers two rules
+ * apart must not answer through different head-extraction machines.
+ */
 function writesToDevice(command, dialect = 'posix') {
-    return parseSegments(command, dialect).some(({ head, args }) => head === 'dd' && args.some((a) => a.startsWith('of=/dev/')));
+    return tokenizeSegments(command, dialect).some((words) => {
+        const idx = effectiveCommandIndex(words);
+        return idx !== -1 && stripPath(words[idx]) === 'dd'
+            && words.slice(idx + 1).some((a) => a.startsWith('of=/dev/'));
+    });
 }
 /**
  * `chown -R … /` — a recursive chown whose target is the filesystem root.
@@ -1501,6 +1513,309 @@ function chownsRoot(command, dialect = 'posix') {
         return positional[positional.length - 1] === '/';
     });
 }
+/**
+ * One dequoted word starting at `start`, as the redirect-target reader needs it.
+ *
+ * Stops at whitespace, at a character that begins another shell construct (`; | & < >
+ * ( )`), or at the end. Quotes are dropped and a closing quote does not end the
+ * word — the shell concatenates what follows it, so `> "/etc/cron.d"/x`,
+ * `> ""~/x` and `> a"b"c` all read as one target (the review round measured the
+ * `break`-on-close reading as a bypass: `> ""~/.ssh/authorized_keys` fell through).
+ * The quote/escape state machine is the same one `tokenizeSegmentsDetailed` runs
+ * (both keyed on DOUBLE_QUOTE_ESCAPABLE); a dialect fix must land in both loops.
+ */
+function readDequotedWord(command, start, dialect) {
+    const n = command.length;
+    if (start >= n || /[\s;&|<>()]/.test(command[start]))
+        return '';
+    let word = '';
+    let quote = command[start] === '"' || command[start] === "'" ? command[start] : null;
+    let escaped = false;
+    for (let i = quote === null ? start : start + 1; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            word += ch;
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\') {
+            if (quote === "'") {
+                word += ch;
+                continue;
+            }
+            if (quote === '"') {
+                const next = command[i + 1];
+                if (next === undefined || DOUBLE_QUOTE_ESCAPABLE.has(next)) {
+                    escaped = true;
+                    continue;
+                }
+                word += ch;
+                continue;
+            }
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+                continue;
+            }
+            word += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/[\s;&|<>()]/.test(ch))
+            break;
+        word += ch;
+    }
+    return word;
+}
+/**
+ * Every shell-redirect target in `command`, dequoted the way the shell will pass it.
+ *
+ * A redirect is an unquoted `>` — alone (`> f`), attached to the word it ends
+ * (`echo x>f`, which bash also reads as a redirect), doubled (`>>`), with an fd
+ * prefix (`2>`, `2>>`), with the both-streams spellings (`&>`, `&>>`, `>&`) or
+ * with the noclobber-override marker (`>|`). A `>` inside quotes is data
+ * (`echo "> f"` prints a string) and yields nothing, which is what separates this
+ * scan from the raw regexes it replaces: those fired on the quoted text too, so a
+ * commit message quoting a redirect was a refusal nobody could switch off
+ * (measured on main).
+ *
+ * The target is the next word after the operator, quoted or attached. An operator
+ * with nothing readable after it is a syntax error the remote shell would report,
+ * and yields nothing. `>(...)` process substitution yields nothing here too — its
+ * inner command is a carrier `nestedCommands` already reads.
+ */
+function redirectTargets(command, dialect) {
+    const targets = [];
+    const n = command.length;
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < n; i++) {
+        const ch = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (dialect === 'posix' && ch === '\\' && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch !== '>' && !(ch === '&' && command[i + 1] === '>'))
+            continue;
+        let j = ch === '&' ? i + 2 : i + 1;
+        if (command[j] === '>')
+            j++; // >>
+        if (command[j] === '&')
+            j++; // >& fd duplication
+        if (command[j] === '|')
+            j++; // >| noclobber override
+        while (j < n && /\s/.test(command[j]))
+            j++;
+        const word = readDequotedWord(command, j, dialect);
+        if (word !== '')
+            targets.push(word);
+        i = j - 1;
+    }
+    return targets;
+}
+/**
+ * xargs's own value-taking flags — one tool's option set, enumerable the way
+ * `PREFIX_VALUE_FLAGS` holds sudo's. `effectiveCommandIndex` steps a wrapper's
+ * flags with *sudo's* set, so `xargs -I {}` leaves `{}` looking like the command
+ * and the verb xargs really runs hides behind it (measured in review:
+ * `xargs -I {} cp {} /root/.ssh/authorized_keys` passed).
+ */
+const XARGS_VALUE_FLAGS = new Set(['-I', '-J', '-d', '-E', '-n', '-s', '-P', '-R', '-L', '-S']);
+/**
+ * The command index for a segment whose wrapper may be `xargs`, which the plain
+ * `effectiveCommandIndex` cannot step past. Same walk, one addition; runs
+ * alongside the plain index so nothing else changes.
+ */
+function indexPastXargsFlags(words) {
+    let i = 0;
+    while (i < words.length) {
+        const raw = words[i];
+        const word = stripPath(unquote(raw));
+        if (word === 'xargs') {
+            i++;
+            while (i < words.length && words[i].startsWith('-')) {
+                const consumesValue = XARGS_VALUE_FLAGS.has(words[i]);
+                i++;
+                if (consumesValue)
+                    i++;
+            }
+            continue;
+        }
+        if (PRIVILEGE_PREFIXES.has(word) || EXEC_WRAPPERS.has(word)) {
+            i++;
+            continue;
+        }
+        if (ASSIGNMENT.test(raw) || raw.startsWith('-') || BARE_NUMERIC.test(raw)) {
+            i++;
+            continue;
+        }
+        return i;
+    }
+    return -1;
+}
+/**
+ * The positional operands of the copy family, with every option spelling that
+ * carries a value stepped over.
+ *
+ * GNU getopt permutes options anywhere in the argv — `install k
+ * /root/.ssh/authorized_keys -m 600` is ordinary usage — so a value-taking flag
+ * trailing the destination must not have its value read as the last positional
+ * (measured in review: it displaced the destination and the write was missed).
+ * `-t`/`--target-directory` in all three spellings (`-t DIR`, `-tDIR`,
+ * `--target-directory=DIR`, `--target-directory DIR`) is stepped here too; the
+ * caller reads its value as the destination itself.
+ */
+function copyPositionals(args) {
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '-t' || arg === '--target-directory') {
+            i++;
+            continue;
+        }
+        if (/^-t.+/.test(arg) || /^--target-directory=/.test(arg))
+            continue;
+        // An attached short value (`-m600`) needs no line of its own: the generic
+        // `-` skip below already keeps it out of the positionals.
+        if (arg === '-m' || arg === '-o' || arg === '-g' || arg === '-S' || arg === '-Z') {
+            i++;
+            continue;
+        }
+        if (/^--(mode|owner|group|suffix|context|sparse)=/.test(arg))
+            continue;
+        if (arg === '--mode' || arg === '--owner' || arg === '--group' || arg === '--suffix'
+            || arg === '--context' || arg === '--sparse') {
+            i++;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        positional.push(arg);
+    }
+    return positional;
+}
+/**
+ * The destination operands of the verbs whose argv names the file they write.
+ *
+ * A closed list, on purpose. `tee` writes every non-flag operand; `cp`, `mv` and
+ * `install` write their destination operand — the value of `-t`/
+ * `--target-directory` in any of its spellings when present, else the last
+ * positional — and, because that operand may name a directory the sources are
+ * copied *into*, the same joined with each source's basename, so `cp
+ * authorized_keys ~/.ssh/` is caught rather than only `cp k
+ * ~/.ssh/authorized_keys`. `install -d` creates every operand. `dd of=` writes
+ * the value. Every other verb is a documented residual: a guess about an
+ * unrecognised binary's operands must not reach this list (the
+ * `speculativeOperands: false` ruling), and #230's decision 1 already ruled that
+ * extracting paths from shell text can never be complete — so the README lists
+ * these forms and names the rest as governed by class and approval instead.
+ *
+ * `env cp …`, `sudo cp …`, `timeout 5 cp …` and `xargs -I {} cp …` reach the
+ * verb through `effectiveCommandIndex` and its xargs-stepping sibling.
+ */
+function writeVerbTargets(command, dialect) {
+    const targets = [];
+    for (const words of tokenizeSegments(command, dialect)) {
+        const heads = [effectiveCommandIndex(words), indexPastXargsFlags(words)]
+            .filter((i, idx, all) => i !== -1 && all.indexOf(i) === idx);
+        for (const idx of heads) {
+            const head = stripPath(words[idx]);
+            const args = words.slice(idx + 1);
+            if (head === 'tee') {
+                targets.push(...args.filter((a) => !a.startsWith('-')));
+                continue;
+            }
+            if (head === 'dd') {
+                for (const arg of args) {
+                    if (arg.startsWith('of='))
+                        targets.push(arg.slice(3));
+                }
+                continue;
+            }
+            if (head === 'cp' || head === 'mv' || head === 'install') {
+                const positional = copyPositionals(args);
+                if (head === 'install' && args.some((a) => a === '-d' || a === '--directory')) {
+                    targets.push(...positional);
+                    continue;
+                }
+                const tIndex = args.findIndex((a) => a === '-t' || a === '--target-directory'
+                    || /^-t.+/.test(a) || a.startsWith('--target-directory='));
+                let dest = null;
+                let sources = positional;
+                if (tIndex !== -1) {
+                    const flag = args[tIndex];
+                    if (flag === '-t' || flag === '--target-directory') {
+                        dest = args[tIndex + 1] || null;
+                    }
+                    else {
+                        const eq = flag.indexOf('=');
+                        dest = eq === -1 ? flag.slice(2) : flag.slice(eq + 1);
+                    }
+                }
+                else if (positional.length >= 2) {
+                    dest = positional[positional.length - 1];
+                    sources = positional.slice(0, -1);
+                }
+                if (dest === null || dest === '')
+                    continue;
+                targets.push(dest);
+                for (const src of sources) {
+                    const base = stripPath(src);
+                    if (base !== '')
+                        targets.push(`${dest}/${base}`);
+                }
+            }
+        }
+    }
+    return targets;
+}
+/**
+ * The never-allowed family cache — same shape and reason as `normalizedCache`:
+ * three ForbiddenRule entries ask the same (command, dialect) question in a row,
+ * and each ask re-ran both scans over the whole command. Keyed with the dialect
+ * because both readings of one command are asked in the same row.
+ */
+const neverAllowedWriteCache = new Map();
+/**
+ * Which never-allowed family this command's certain write forms name, or null.
+ * Both dialects are tried by the caller (findForbiddenMatchInDialect), and nested
+ * commands reach this through the same recursion every other rule uses.
+ */
+function findNeverAllowedWriteFamily(command, dialect) {
+    const key = `${dialect}\u0000${command}`;
+    if (neverAllowedWriteCache.has(key))
+        return neverAllowedWriteCache.get(key);
+    let family = null;
+    for (const candidate of [...redirectTargets(command, dialect), ...writeVerbTargets(command, dialect)]) {
+        family = findNeverAllowedWriteTarget(candidate);
+        if (family !== null)
+            break;
+    }
+    neverAllowedWriteCache.set(key, family);
+    if (neverAllowedWriteCache.size > 8) {
+        neverAllowedWriteCache.delete(neverAllowedWriteCache.keys().next().value);
+    }
+    return family;
+}
 const FORBIDDEN_RULES = [
     ...FORBIDDEN_PATTERNS.map((re) => ({
         label: String(re),
@@ -1516,6 +1831,10 @@ const FORBIDDEN_RULES = [
     },
     { label: 'dd writing to a block device (of=/dev/…)', test: (c, dialect) => writesToDevice(c, dialect) },
     { label: 'a recursive chown of the filesystem root', test: (c, dialect) => chownsRoot(c, dialect) },
+    ...['/etc/cron', '/etc/systemd', 'authorized_keys'].map((family) => ({
+        label: neverAllowedWriteLabel(family),
+        test: (command, dialect) => findNeverAllowedWriteFamily(command, dialect) === family,
+    })),
 ];
 /**
  * Which never-allowed rule this command trips, or null. The single entry point:
@@ -2109,9 +2428,10 @@ function classifyCommandInDialect(command, depth, dialect) {
         if (CLASS_RANK[parsed.class] > CLASS_RANK[highest.class])
             highest = parsed;
     }
-    // `readOnlyRejection` only ever describes the outer command's own grammar
-    // rejection, and only means anything when that is also what decided the
-    // final class. `highest === outer` (reference equality) is exactly that
+    // `readOnlyRejection` only ever describes why the outer command's reader was
+    // refused read-only — a grammar rejection or a shell metacharacter, see
+    // `ReadOnlyRejection` — and only means anything when that is also what decided
+    // the final class. `highest === outer` (reference equality) is exactly that
     // condition: the synthetic floor and the nested-command loop above only
     // ever replace `highest` with something of strictly higher rank than
     // `outer`'s, so if either one fired, `highest` is no longer `outer` and the
@@ -2153,8 +2473,20 @@ function classifyOuter(trimmed, dialect) {
     const twoWordPrefix = words.slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)
         || READ_ONLY_SYNTHETIC.has(binary)) {
-        if (SHELL_CONTROL_CHARS.test(trimmed)) {
-            return { binary, fullCommand, class: 'safe' };
+        // Whichever key matched decides both which entry answers and how many
+        // leading words are the command name rather than an argument: a two-word
+        // entry's grammar reads words[2..], a one-word entry's reads words[1..]. An
+        // SFTP verb's two-word prefix is never a key, so it is named by itself.
+        const matchedTwoWord = READ_ONLY_ALLOWLIST.has(twoWordPrefix);
+        const readerName = matchedTwoWord ? twoWordPrefix : binary;
+        const metacharacter = SHELL_CONTROL_CHARS.exec(trimmed);
+        if (metacharacter) {
+            return {
+                binary,
+                fullCommand,
+                class: 'safe',
+                readOnlyRejection: { binary: readerName, word: metacharacter[0], cause: 'shell-metacharacter' },
+            };
         }
         // The SFTP verbs are synthesised by the tool layer, never typed by a caller,
         // so there is no argv for a grammar to read — READ_ONLY_SYNTHETIC stays
@@ -2162,11 +2494,6 @@ function classifyOuter(trimmed, dialect) {
         if (READ_ONLY_SYNTHETIC.has(binary)) {
             return { binary, fullCommand, class: 'read-only' };
         }
-        // Whichever key matched decides both which entry answers and how many
-        // leading words are the command name rather than an argument: a two-word
-        // entry's grammar reads words[2..], a one-word entry's reads words[1..].
-        const matchedTwoWord = READ_ONLY_ALLOWLIST.has(twoWordPrefix);
-        const readerName = matchedTwoWord ? twoWordPrefix : binary;
         const entry = READERS[readerName];
         const argWords = words.slice(matchedTwoWord ? 2 : 1);
         // An unquoted glob word is not a word this grammar can vouch for: the
@@ -2182,7 +2509,7 @@ function classifyOuter(trimmed, dialect) {
                     binary,
                     fullCommand,
                     class: 'safe',
-                    readOnlyRejection: { binary: readerName, word: globWord },
+                    readOnlyRejection: { binary: readerName, word: globWord, cause: 'grammar' },
                 };
             }
         }
@@ -2192,7 +2519,7 @@ function classifyOuter(trimmed, dialect) {
                 binary,
                 fullCommand,
                 class: 'safe',
-                readOnlyRejection: { binary: readerName, word: match.word },
+                readOnlyRejection: { binary: readerName, word: match.word, cause: 'grammar' },
             };
         }
         return { binary, fullCommand, class: 'read-only' };
@@ -2200,17 +2527,40 @@ function classifyOuter(trimmed, dialect) {
     return { binary, fullCommand, class: 'safe' };
 }
 /**
- * The sentence a refusal appends when it carries a `readOnlyRejection`, worded
- * so the reason names the binary that would have qualified and the argv word
- * that cost it: "is not accepted there" rather than "is not one of them",
- * because most rejections are operand rules (`hostname NAME`, `sort /data`) or
- * a listed value flag missing its value, where "is not one of them" would be
- * false — it may be a perfectly good flag name, just not one bare or in this
- * position. One function so the engine's role-binding denial and
- * `read-command`'s `enforceClass` refusal never drift into two spellings of
- * the same sentence.
+ * The sentence a refusal appends when it carries a `readOnlyRejection`, in one of
+ * two shapes chosen by its `cause`. Both name the reader that would have qualified
+ * and what cost it the class.
+ *
+ * - `grammar`: names the argv word, as "is not accepted there" rather than "is not
+ *   one of them", because most rejections are operand rules (`hostname NAME`,
+ *   `sort /data`) or a listed value flag missing its value, where "is not one of
+ *   them" would be false — it may be a perfectly good flag name, just not one bare
+ *   or in this position.
+ * - `shell-metacharacter`: names the character, and for the SFTP verbs says it is
+ *   in the remote path (#224).
+ *
+ * One function so the engine's role-binding denial and `read-command`'s
+ * `enforceClass` refusal never drift into two spellings of the same sentence.
  */
 function formatReadOnlyRejection(rejection) {
+    if (rejection.cause === 'shell-metacharacter') {
+        // `\n` and `\r` are in SHELL_CONTROL_CHARS, and quoted raw they would break the
+        // sentence across lines or render as nothing. A backtick is in it too, and inside
+        // single backticks it would print as three in a row; double backticks with
+        // padding is Markdown's own way to quote one.
+        const char = rejection.word.replace(/\n/g, '\\n').replace(/\r/g, '\\r');
+        const quoted = char === '`' ? '`` ` ``' : `\`${char}\``;
+        // The SFTP verbs' operand is a path the tool layer built the command from, so the
+        // path is what the caller can change — not "the command", which they never typed.
+        // The verb is named as the audit record spells it (`sftp:list`), not as the tool
+        // (`sftp-list`), so the refusal and the record it is filed under read the same.
+        if (READ_ONLY_SYNTHETIC.has(rejection.binary)) {
+            return `The remote path contains ${quoted}, which counts as a shell metacharacter here, ` +
+                `so \`${rejection.binary}\` is read-only only for a path without one.`;
+        }
+        return `\`${rejection.binary}\` is read-only only when the command contains no shell metacharacter; ` +
+            `${quoted} is one.`;
+    }
     // The rejected word can be the empty string — a quoted empty operand
     // (`hostname ""`) — and two bare backticks would render as a blank where
     // the word that cost the class should be. `""` is the shell's own spelling

package/build/policy/engine.js

@@ -1,6 +1,9 @@
 import { classifyCommand, findForbiddenMatch, formatReadOnlyRejection } from './classifier.js';
 import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+import { findNeverAllowedWriteTarget, neverAllowedWriteLabel } from './never-allowed-writes.js';
 import { OperatorError } from '../errors.js';
+/** The operator-facing promise every built-in never-allowed refusal ends with. */
+const NEVER_ALLOWED_TRAILER = 'This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.';
 /**
  * How long to wait for the OPA sidecar before treating it as unavailable.
  *
@@ -316,6 +319,7 @@ export class PolicyEngine {
                     binary: parsed.binary,
                     host: profile.host,
                     remotePath,
+                    remoteWrite: resource.remoteWrite || undefined,
                     remotePathNormalized: remotePath === undefined ? undefined : normalizeRemotePath(remotePath),
                     remotePathWindows: remotePath === undefined ? undefined : normalizeRemotePathForWindows(remotePath),
                 },
@@ -449,9 +453,9 @@ export class PolicyEngine {
             }
         }
         // A `safe` command refused here is often not a hard "no" — it is one
-        // argv word away from `read-only`, and without this the reader concludes
-        // the binary is forbidden outright and never learns which spelling would
-        // have worked.
+        // spelling away from `read-only` (an argv word the grammar refused, or a
+        // shell metacharacter), and without this the reader concludes the binary is
+        // forbidden outright and never learns which spelling would have worked.
         if (parsed.readOnlyRejection) {
             reason += ` ${formatReadOnlyRejection(parsed.readOnlyRejection)}`;
         }
@@ -505,8 +509,17 @@ export class PolicyEngine {
     findDenyMatch(command, resource) {
         const builtIn = findForbiddenMatch(command);
         if (builtIn) {
-            return `Command matches a built-in never-allowed rule: ${builtIn}. ` +
-                `This list cannot be switched off — the [policy].denylist key adds patterns, it does not remove these.`;
+            return `Command matches a built-in never-allowed rule: ${builtIn}. ${NEVER_ALLOWED_TRAILER}`;
+        }
+        // The built-in never-allowed write paths, tested against a remote path the tool
+        // declared it writes. Runs before the early return below because the defaults
+        // carry no operator denylist — this check is not the operator's to switch on.
+        if (resource.remoteWrite && resource.remotePath) {
+            const target = findNeverAllowedWriteTarget(resource.remotePath);
+            if (target !== null) {
+                return `Remote path ${quotePath(resource.remotePath)} matches a built-in never-allowed rule: ` +
+                    `${neverAllowedWriteLabel(target)}. ${NEVER_ALLOWED_TRAILER}`;
+            }
         }
         // Nothing below can match: skip reading the path at all, which is the commonest
         // config — the defaults carry no denylist.

package/build/policy/never-allowed-writes.js

@@ -0,0 +1,51 @@
+import { normalizeRemotePath, normalizeRemotePathForWindows } from './remote-path.js';
+/**
+ * The `/etc` families are prefix matches with no boundary: `/etc/crontab` sits under
+ * `/etc/cron` the same way `/etc/cron.d/x` does, which is how the redirect regex this
+ * module replaces always read it. A sibling that merely starts like the directory
+ * (`/etc/cronography`) fires too — over-refusal in the fail-closed direction this
+ * engine takes everywhere else.
+ */
+const NEVER_DIRS = ['/etc/cron', '/etc/systemd'];
+/** The keys family: any path whose last two segments are `.ssh/authorized_keys`. */
+const KEYS_TAIL = '/.ssh/authorized_keys';
+/**
+ * The refusal wording for a family, defined once because two check sites quote it:
+ * the classifier's ForbiddenRule label and the engine's built-in deny reason.
+ */
+export function neverAllowedWriteLabel(target) {
+    switch (target) {
+        case '/etc/cron': return 'writing to /etc/cron';
+        case '/etc/systemd': return 'writing to /etc/systemd';
+        case 'authorized_keys': return "writing to any user's authorized_keys";
+    }
+}
+function familyOf(path) {
+    for (const dir of NEVER_DIRS) {
+        if (path.startsWith(dir))
+            return dir;
+    }
+    if (path.endsWith(KEYS_TAIL) || path === KEYS_TAIL.slice(1))
+        return 'authorized_keys';
+    return null;
+}
+/**
+ * Whether `path` names one of the never-allowed write targets, in any spelling the
+ * path readings resolve.
+ *
+ * The same three readings `[policy].denylist` sees (#230): the path as given; a
+ * lexically normalized reading (`//`, `/./`, `..`, trailing separators, `\` as a
+ * separator); and the Windows reading of it, case-insensitively — so `Authorized_Keys.`,
+ * `authorized_keys::$DATA` and backslash spellings reach the same refusal. On a POSIX
+ * target some of those are different files; refusing them is the safe direction, the
+ * same trade the operator denylist already makes.
+ *
+ * What this does not do is resolve anything on the target: a relative path stays
+ * relative, symlinks are not followed, and an 8.3 short name is not expanded (#230's
+ * documented residuals, inherited here).
+ */
+export function findNeverAllowedWriteTarget(path) {
+    return familyOf(path)
+        ?? familyOf(normalizeRemotePath(path))
+        ?? familyOf(normalizeRemotePathForWindows(path).toLowerCase());
+}

package/build/tools/file-tools.js

@@ -53,7 +53,7 @@ export function registerFileTools({ server }, pipeline) {
             profile,
             extra,
             synthetic: true,
-            resource: { remotePath },
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); },
         }, async (rt) => {
             await new SftpClient(rt.conn).upload({ remotePath, content });

package/build/tools/pipeline.js

@@ -170,11 +170,12 @@ export function createPipeline({ server, registry, policy, audit, approvalGrantT
             const { conn, evaluation, approver } = await checkPolicyAndApprove(effective, profileName, opts.toolName, opts.resource);
             state.evaluation = evaluation;
             if (opts.enforceClass && evaluation.commandClass !== opts.enforceClass) {
-                // A command that fell to `safe` because a reader's grammar rejected one
-                // of its argv words is one spelling away from the class this tool
-                // demands — say which word, or the caller only learns that the tool
-                // refused it, not why the reader that ran the exact same binary
-                // would not have.
+                // A command that fell to `safe` because a reader was refused read-only —
+                // its grammar rejected an argv word, or the command carries a shell
+                // metacharacter — is one spelling away from the class this tool demands.
+                // Say which word or character, or the caller only learns that the tool
+                // refused it, not why the reader that ran the exact same binary would
+                // not have.
                 const rejectionSuffix = evaluation.readOnlyRejection
                     ? ` ${formatReadOnlyRejection(evaluation.readOnlyRejection)}`
                     : '';

package/build/tools/transfer-tools.js

@@ -256,7 +256,7 @@ export function registerTransferTools({ server, localPath }, pipeline) {
             profile,
             extra,
             synthetic: true,
-            resource: { remotePath },
+            resource: { remotePath, remoteWrite: true },
             preCheck: () => { sanitizeRemotePath(remotePath); checkMode(mode); },
         }, async (rt) => {
             const maxBytes = rt.conn.profile.transferMaxBytes;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.18.0",
+  "version": "2.19.1",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",
@@ -14,7 +14,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.test.json",
     "inspect": "npx @modelcontextprotocol/inspector node build/index.js",
     "changeset": "changeset",
-    "version": "changeset version && node scripts/sync-server-json.mjs",
+    "version": "changeset version && node scripts/sync-server-json.mjs && node scripts/sync-lockfile-version.mjs",
     "test": "cross-env SSH_MCP_DISABLE_MAIN=1 vitest --run",
     "test:unit": "cross-env SSH_MCP_DISABLE_MAIN=1 vitest --run test/unit/ test/property/",
     "test:integration": "cross-env SSH_MCP_DISABLE_MAIN=1 vitest --run test/integration/",
@@ -27,7 +27,7 @@
     "build"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
     "@opentelemetry/resources": "^2.9.0",