ssh-mcp 2.5.1 → 2.7.0

package/build/policy/classifier.js

@@ -82,7 +82,19 @@ const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
     />\s*\/dev\/sd/,
-    /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
+    // Fork bomb, with whitespace allowed at the five positions bash allows it and the old
+    // pattern did not: before the parentheses, inside them, either side of the pipe, and
+    // before the ampersand. `: () { : | : & } ; :` ran and classified `safe`.
+    //
+    // What this still does not catch, so that nobody reads it as "fork bombs are handled":
+    // the same bomb under another name (`f(){ f|f& };f`), a body that separates the two
+    // calls with `&` or `;` rather than `|` (`:(){ :&:& };:`), and a comment between the
+    // tokens (`:() # x\n{ :|:& };:`). Matching the first needs a backreference over an
+    // unbounded body and this file has already shipped one ReDoS; the others would widen a
+    // list no role, tier or approval mode can override. The impact is a denial of service
+    // against the target host rather than against this server, which is not worth either
+    // trade — but it is a hole, not a closed door.
+    /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
@@ -135,9 +147,45 @@ const CLASS_RANK = {
     privileged: 3,
 };
 /** Shells that run their next argument as a command when given `-c`. */
-const SHELL_BINARIES = new Set([
-    'sh', 'bash', 'dash', 'zsh', 'ksh', 'ash', 'busybox',
-]);
+/**
+ * Interpreters, the flags that hand them a program, and whether this file can read it.
+ *
+ * One table rather than three overlapping name lists: adding an interpreter here is the
+ * whole change, and a shell list that drifts out of step with a readability list is how a
+ * new shell ends up treated as an unreadable interpreter.
+ *
+ * `readable` means the program is shell, so classifying it is this same job done again
+ * and the class it earns is real. Python, Perl, Ruby, Node and PHP are not: their program
+ * is a different language, and `os.system('sudo id')` carries an elevation the shell
+ * classifier cannot see. Pretending to parse them would be a worse answer than admitting
+ * we cannot, so an unreadable program makes the command `destructive` — "we cannot tell",
+ * not "this is root", the same answer `hasUnnameableCommand` gives.
+ *
+ * `busybox` is not here: it takes an applet name, not `-c`, so `busybox sh -c …` is an
+ * `sh` invocation behind a wrapper. It is in EXEC_WRAPPERS instead, which is what it is.
+ */
+// Null-prototype for the reason `mergePolicyRules` spells out (#172): this is indexed by
+// a command word, which is a free string, so on a plain object `INTERPRETERS['toString']`
+// resolves to a function and reading `.flags` off it throws inside the policy gate.
+const INTERPRETERS = Object.assign(Object.create(null), {
+    sh: { flags: ['-c'], readable: true },
+    bash: { flags: ['-c'], readable: true },
+    dash: { flags: ['-c'], readable: true },
+    zsh: { flags: ['-c'], readable: true },
+    ksh: { flags: ['-c'], readable: true },
+    ash: { flags: ['-c'], readable: true },
+    python: { flags: ['-c'], readable: false },
+    python2: { flags: ['-c'], readable: false },
+    python3: { flags: ['-c'], readable: false },
+    perl: { flags: ['-e', '-E'], readable: false },
+    ruby: { flags: ['-e'], readable: false },
+    // `-p`/`--print` evaluate exactly as `-e` does and then print the result.
+    node: { flags: ['-e', '--eval', '-p', '--print'], readable: false },
+    php: { flags: ['-r'], readable: false },
+});
+/** Flags whose value is a separate word, which is not the program. `awk -F ':' '{…}'`. */
+/** `find … -exec <cmd> +` runs cmd. */
+const FIND_EXEC_FLAGS = new Set(['-exec', '-execdir', '-ok', '-okdir']);
 /**
  * How deep a substitution may nest before we stop reading and refuse to guess.
  *
@@ -147,39 +195,156 @@ const SHELL_BINARIES = new Set([
  */
 const MAX_NESTING_DEPTH = 8;
 /**
- * Split on whitespace the way a shell would, keeping quoted runs together.
+ * Split a command into segments of words, resolving quoting as a shell would.
+ *
+ * The classifier's regexes were written against the command as sent, but the transport
+ * removes quoting before the command runs, so `rm -rf "/etc"` matched no destructive
+ * pattern and `s"u"do id` named no privilege prefix. Every consumer that used to split on
+ * `/[;&|\n]/` and `/\s+/` reads this instead, so quote removal happens once, in one
+ * place, rather than being re-derived per rule.
  *
- * `parseSegments` splits on `/\s+/`, which turns `sh -c "sudo id"` into
- * `["sh", "-c", "\"sudo", "id\""]` — the argument is no longer a unit, so nothing
- * downstream can classify it as the command it is.
+ * Not a shell parser. Variable expansion, arithmetic and here-documents are out of scope —
+ * `hasUnnameableCommand` is what refuses a command word this cannot resolve.
  */
-function splitRespectingQuotes(command) {
-    const words = [];
+function tokenizeSegments(command) {
+    return tokenizeSegmentsDetailed(command).map((segment) => segment.words);
+}
+/**
+ * The same split, keeping the separator that introduced each segment.
+ *
+ * Only the pipe rules need it: `|` feeds one command's output into the next, while `;`
+ * and `&` merely sequence, and a rule about pipes must not fire on a rule about sequences.
+ * Deriving both views from one tokeniser is what stops the two from drifting apart.
+ */
+function tokenizeSegmentsDetailed(command, honorQuotes = true) {
+    const segments = [];
+    let pending = '';
+    let words = [];
     let current = '';
     let quote = null;
+    let escaped = false;
+    const endWord = () => {
+        if (current)
+            words.push(current);
+        current = '';
+    };
+    const endSegment = (sep) => {
+        endWord();
+        if (words.length > 0)
+            segments.push({ words, sep: pending });
+        words = [];
+        pending = sep;
+    };
     for (const ch of command) {
+        if (escaped) {
+            // A backslash quotes the next character, so `\reboot` runs reboot. Keeping the
+            // character and dropping the backslash is what the shell does.
+            current += ch;
+            escaped = false;
+            continue;
+        }
         if (quote) {
+            // Backslash is literal inside single quotes; inside double quotes it escapes.
+            if (ch === '\\' && quote === '"') {
+                escaped = true;
+                continue;
+            }
             if (ch === quote)
                 quote = null;
             else
                 current += ch;
             continue;
         }
-        if (ch === '"' || ch === "'") {
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (honorQuotes && (ch === '"' || ch === "'")) {
             quote = ch;
             continue;
         }
+        if (ch === ';' || ch === '&' || ch === '|' || ch === '\n') {
+            endSegment(ch);
+            continue;
+        }
         if (/\s/.test(ch)) {
-            if (current)
-                words.push(current);
-            current = '';
+            endWord();
             continue;
         }
         current += ch;
     }
-    if (current)
-        words.push(current);
-    return words;
+    endSegment('');
+    // A quote left open at the end is not a command a shell would run — it is a syntax
+    // error. Reading it as one long quoted argument is the dangerous reading: `echo "hi;
+    // sudo id` then never splits on the `;` and the elevation disappears, which measured as
+    // `privileged` before this tokeniser and `safe` after. So fall back to the scan that
+    // treats the quote character as ordinary text, which splits and still sees `sudo id`.
+    if (quote !== null)
+        return tokenizeSegmentsDetailed(command, false);
+    return segments;
+}
+/**
+ * The command rebuilt from its tokens, for the regex rules to match against.
+ *
+ * Segments are rejoined with `; ` so a pattern cannot match across two commands that the
+ * shell would run separately.
+ */
+let lastNormalizedInput = null;
+let lastNormalizedOutput = '';
+function normalizeCommand(command) {
+    // One evaluate asks for this about nineteen times, once per regex rule, and each ask
+    // re-ran the tokeniser over the whole command. The asks arrive in a row on the same
+    // input, so a one-entry cache removes almost all of it.
+    if (command === lastNormalizedInput)
+        return lastNormalizedOutput;
+    lastNormalizedInput = command;
+    lastNormalizedOutput = normalizeUncached(command);
+    return lastNormalizedOutput;
+}
+function normalizeUncached(command) {
+    return tokenizeSegments(command)
+        .map((words) => words.map((w) => (QUOTED_CONTENT.test(w) ? PLACEHOLDER : w)).join(' '))
+        .join('; ');
+}
+/**
+ * A character the tokeniser splits on or at, which a token can only hold if it was quoted.
+ *
+ * The tokeniser splits on unquoted separators and at unquoted whitespace, so a token
+ * holding either came from inside quotes — the shell will not split there, and its contents are data. Rejoining it
+ * into the pattern text is what makes an argument read as a command: `echo "hello; rm -rf
+ * /"` prints a string, and normalising it produced `echo hello; rm -rf /`, which matched
+ * the never-allowed list. Dropping those tokens keeps quote removal doing the job it was
+ * added for — `rm -rf "/etc"`, whose tokens hold no separator — without letting a quoted
+ * argument impersonate a command. A carrier that really does hand over a quoted command
+ * (`sh -c "ls; rm -rf /etc"`) is read by `nestedCommands`, not by this.
+ */
+const QUOTED_CONTENT = /[\s;&|\n]/;
+/**
+ * What a quoted token becomes in the pattern text.
+ *
+ * Deleting it instead spliced its neighbours together and created an adjacency that appears
+ * nowhere in the command: `echo rm 'a|b' -rf /` normalised to `echo rm -rf /` and landed on
+ * the never-allowed list. A character no pattern contains and `\s` does not match stands in
+ * its place, so the two sides can no longer be read as one phrase.
+ */
+const PLACEHOLDER = '\u0000';
+/**
+ * Try a regex against the command as written and against the tokenised form.
+ *
+ * Normalising alone is not enough. It rebuilds the command from tokens, so the shell
+ * metacharacters between them are gone, and a pattern that matches across a separator no
+ * longer fires — the fork bomb, whose `:|:&` needs the literal `|` and `&`, is the case
+ * that shows this. Normalising is still what defeats `rm -rf "/etc"`. Neither form is a
+ * superset of the other, so both are tried: for a pattern whose whole job is to notice
+ * something, the union is the only direction that cannot lose a match.
+ *
+ * Deliberately scoped to regexes. The word-based rules in `FORBIDDEN_RULES` already
+ * tokenise, and handing them the normalised string turns a separator that was safely
+ * inside a quoted argument into a real one — `grep -E "warn|reboot" syslog` became an
+ * unconditional refusal, which is the mention-vs-invocation bug of #91 all over again.
+ */
+function matchesEitherForm(command, test) {
+    return test(command) || test(normalizeCommand(command));
 }
 /**
  * The commands hiding inside a command.
@@ -230,24 +395,58 @@ export function nestedCommands(command) {
         for (const raw of backticks)
             found.push(raw.slice(1, -1));
     }
-    // `sh -c <command>`. Carries no substitution at all, so the scan above does not
-    // see it; found while mapping the reported bypass rather than in the report.
-    const words = splitRespectingQuotes(command);
-    for (let i = 0; i < words.length; i++) {
-        if (!SHELL_BINARIES.has(stripPath(unquote(words[i]))))
-            continue;
-        for (let j = i + 1; j < words.length; j++) {
-            if (words[j] === '-c') {
-                if (words[j + 1] !== undefined)
-                    found.push(words[j + 1]);
-                break;
+    // A carrier hands a program to something that runs it. Carries no substitution, so the
+    // scan above does not see it. Read each segment's command word rather than scanning
+    // every word: matching a mention rather than an invocation is #91, and
+    // `cat /usr/bin/python3` names an interpreter without running one.
+    const segments = tokenizeSegmentsDetailed(command);
+    for (const { words } of segments) {
+        // Every word, not just the command word. Stopping at the head lost the carrier behind
+        // any wrapper this file does not list: `xargs -I {} sh -c 'sudo id'` stops on `{}`, and
+        // `flock`, `chroot`, `nsenter` and `systemd-run` are not wrappers it knows — all six
+        // went from `privileged` to `safe`. What keeps this from matching a *mention* is not
+        // where it looks but what it requires: `programAfterFlag` returns null unless a
+        // program-bearing flag actually follows, so `cat /usr/bin/python3` carries nothing.
+        //
+        // awk is deliberately absent. Its program is a positional operand rather than the
+        // value of a flag, so nothing distinguishes running awk from naming it, and its four
+        // implementations disagree about which flags consume a value — modelling that wrongly
+        // opened five separate holes across two review rounds. `awk` keeps the class it has on
+        // 2.5.1 and is tracked separately.
+        if (!operandsAreData(words)) {
+            for (let i = 0; i < words.length; i++) {
+                const spec = INTERPRETERS[stripPath(unquote(words[i]))];
+                if (spec === undefined || isFlagValue(words, i, spec.flags))
+                    continue;
+                const program = programAfterFlag(words, i, spec.flags);
+                if (program !== null)
+                    found.push(program);
             }
-            // Only flags may sit between the shell and its `-c`; anything else means
-            // this was not a `-c` invocation.
-            if (!words[j].startsWith('-'))
-                break;
+        }
+        // `-exec` is a flag rather than a command word, so this one is still a scan.
+        for (let i = 0; i < words.length; i++) {
+            if (!FIND_EXEC_FLAGS.has(words[i]) || words[i + 1] === undefined)
+                continue;
+            const rest = words.slice(i + 1);
+            const stop = rest.findIndex((w) => w === '+' || w === ';');
+            found.push((stop === -1 ? rest : rest.slice(0, stop)).join(' '));
+            // Step past what was consumed. Leaving `i` where it was emitted one child per
+            // `-exec` token, each an overlapping suffix of the last and each still holding the
+            // rest of them, so the recursion re-expanded the same tail once per token: twenty
+            // `-ok` tokens in 81 bytes cost 17 seconds of a single-threaded event loop.
+            i = stop === -1 ? words.length : i + 1 + stop;
         }
     }
+    // A pipe stage whose command word is an interpreter with no program of its own runs
+    // whatever the previous stage printed. Starts at 1: a leading `|` records its separator
+    // on the first segment, and reading `segments[-1]` threw.
+    for (let i = 1; i < segments.length; i++) {
+        if (segments[i].sep !== '|')
+            continue;
+        if (!readsProgramFromStdin(segments[i].words))
+            continue;
+        found.push(segments[i - 1].words.join(' '));
+    }
     return found.filter((c) => c.trim().length > 0);
 }
 const PRIVILEGE_PREFIXES = new Set([
@@ -255,6 +454,8 @@ const PRIVILEGE_PREFIXES = new Set([
     // BusyBox/Alpine, Docker entrypoints, the Rust sudo now default on some
     // distributions, systemd's replacement, and the Solaris/illumos spelling.
     'su-exec', 'gosu', 'sudo-rs', 'run0', 'pfexec',
+    // Both reach root with the command otherwise classified `safe`.
+    'runuser', 'setpriv',
 ]);
 /**
  * Binaries whose job is to run another command.
@@ -273,6 +474,8 @@ const PRIVILEGE_PREFIXES = new Set([
 const EXEC_WRAPPERS = new Set([
     'env', 'nohup', 'nice', 'ionice', 'command', 'exec', 'setsid', 'stdbuf',
     'timeout', 'chrt', 'taskset', 'xargs', 'watch',
+    // `busybox <applet>` runs the applet, so it wraps rather than interprets.
+    'busybox',
 ]);
 /**
  * Arguments that turn an allowlisted binary into one that writes or executes.
@@ -283,9 +486,8 @@ const EXEC_WRAPPERS = new Set([
  * \;` form only escaped because `;` happens to be a shell metacharacter, while
  * the `+` terminator carries none.
  */
-const DISQUALIFYING_ARGS = {
-    find: /^-(exec|execdir|ok|okdir|delete|fprintf?|fls)$/,
-};
+// Null-prototype for the same reason as INTERPRETERS: indexed by the command word.
+const DISQUALIFYING_ARGS = Object.assign(Object.create(null), { find: /^-(exec|execdir|ok|okdir|delete|fprintf?|fls)$/ });
 /** A leading `NAME=value`, which a shell treats as an assignment, not a command. */
 const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
 /** `timeout 5s`, `nice 10` — a bare argument some wrappers take before the command. */
@@ -317,8 +519,16 @@ function stripPath(word) {
 }
 function parseSegments(command) {
     const segments = [];
-    for (const raw of command.split(/[;&|\n]/)) {
-        const words = raw.trim().split(/\s+/).filter(Boolean);
+    for (const words of tokenizeSegments(command)) {
+        const segment = parseWords(words);
+        if (segment !== null)
+            segments.push(segment);
+    }
+    return segments;
+}
+/** The same, for callers that already hold the tokenised words. */
+function parseWords(words) {
+    {
         let i = 0;
         while (i < words.length && PRIVILEGE_PREFIXES.has(stripPath(words[i]))) {
             i++;
@@ -330,10 +540,10 @@ function parseSegments(command) {
             }
         }
         if (i < words.length) {
-            segments.push({ head: stripPath(words[i]), args: words.slice(i + 1) });
+            return { head: stripPath(words[i]), args: words.slice(i + 1) };
         }
     }
-    return segments;
+    return null;
 }
 /**
  * Whether a segment asks for elevation, reading past anything that is not yet
@@ -395,8 +605,8 @@ function elevatedBinary(words) {
  * privileged decision — in the audit log, the OTel span and OPA's input (#134).
  */
 function elevatedBinaryOf(command) {
-    for (const segment of command.split(/[;&|\n]/)) {
-        const found = elevatedBinary(segment.trim().split(/\s+/).filter(Boolean));
+    for (const words of tokenizeSegments(command)) {
+        const found = elevatedBinary(words);
         if (found !== null)
             return found;
     }
@@ -441,7 +651,13 @@ const DOWNLOADERS = new Set(['curl', 'wget']);
  * running one when it succeeds.
  */
 function pipesDownloadIntoShell(command) {
-    const heads = command.split('|').map((part) => parseSegments(part)[0]?.head);
+    // One head per pipe stage. Splitting on every separator would make `curl -O x;
+    // bash build.sh` — download, then run a local script — match a rule whose label says
+    // "piping a download into a shell", on a list that cannot be switched off.
+    const segments = tokenizeSegmentsDetailed(command);
+    const heads = segments
+        .filter((segment, i) => i === 0 || segment.sep === '|')
+        .map((segment) => parseWords(segment.words)?.head);
     const firstDownload = heads.findIndex((h) => h !== undefined && DOWNLOADERS.has(h));
     if (firstDownload === -1)
         return false;
@@ -466,7 +682,10 @@ function chownsRoot(command) {
     });
 }
 const FORBIDDEN_RULES = [
-    ...FORBIDDEN_PATTERNS.map((re) => ({ label: String(re), test: (c) => re.test(c) })),
+    ...FORBIDDEN_PATTERNS.map((re) => ({
+        label: String(re),
+        test: (c) => matchesEitherForm(c, (form) => re.test(form)),
+    })),
     {
         label: 'invoking a power-state command (shutdown, reboot, halt, poweroff) or eval',
         test: (command) => invokedWords(command).some((w) => FORBIDDEN_INVOCATIONS.has(w)),
@@ -524,7 +743,8 @@ const DESTRUCTIVE_PATTERNS = [
  * either.
  */
 function isDestructive(command) {
-    return isForbidden(command) || DESTRUCTIVE_PATTERNS.some((re) => re.test(command));
+    return (isForbidden(command) ||
+        matchesEitherForm(command, (form) => DESTRUCTIVE_PATTERNS.some((re) => re.test(form))));
 }
 const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*sudo\b/,
@@ -533,7 +753,12 @@ const LEADING_PRIVILEGE_PREFIXES = [
     /^\s*pkexec\b/,
 ];
 export function extractBinary(command) {
-    let cmd = command.trim();
+    // The first segment's words, so quoting is resolved — `s"u"do id` used to report
+    // `s"u"do` in the audit record and the refusal message. Reading the normalised whole
+    // command instead would be wrong in the other direction: it rejoins segments with
+    // `; `, so `ls | grep x` would report `ls;`, and this name reaches the audit record,
+    // the OTel span and OPA's input (#134). A separator is not a binary.
+    let cmd = (tokenizeSegments(command)[0] ?? []).join(' ').trim();
     for (const prefix of LEADING_PRIVILEGE_PREFIXES) {
         cmd = cmd.replace(prefix, '').trim();
     }
@@ -551,6 +776,16 @@ export function extractBinary(command) {
  * whether that name is knowable at all.
  */
 function effectiveCommandWord(words) {
+    const i = effectiveCommandIndex(words);
+    return i === -1 ? null : words[i];
+}
+/**
+ * The position of that word, for callers that need to read its arguments.
+ *
+ * Deriving the word from the index rather than searching for it afterwards is what keeps
+ * `sh x sh -c 'sudo id'` from finding the wrong `sh`.
+ */
+function effectiveCommandIndex(words) {
     let i = 0;
     while (i < words.length) {
         const raw = words[i];
@@ -569,10 +804,167 @@ function effectiveCommandWord(words) {
             i++;
             continue;
         }
-        return raw;
+        return i;
+    }
+    return -1;
+}
+/**
+ * Whether this segment's command word is one whose operands are data.
+ *
+ * The carrier scan reads every word, because a wrapper this file does not list would
+ * otherwise hide `sh -c`. The cost is that an outer tool's own flag can be mistaken for an
+ * interpreter's: `grep python3 -c /var/log/x` counts lines, and `-c` is also python's
+ * program flag. An allowlisted command is one this file already vouches for as reading
+ * rather than running, so its arguments are subjects, not commands — the positive form of
+ * the mention-vs-invocation rule at #91. `find` keeps its `-exec` scan, which is separate.
+ */
+function operandsAreData(words) {
+    const idx = effectiveCommandIndex(words);
+    return idx !== -1 && READ_ONLY_ALLOWLIST.has(stripPath(unquote(words[idx])));
+}
+/**
+ * Whether an interpreter name is the value of the flag before it rather than a command.
+ *
+ * The scan looks at every word so that a carrier behind an unlisted wrapper is not lost,
+ * and requires a program-bearing flag to follow before it believes one. That is not quite
+ * enough: `grep -e perl -e python` puts `perl` after a flag and a second `-e` after it,
+ * which reads as perl being handed a program. A search term is not a command.
+ *
+ * The test is deliberately narrow — the preceding flag must be one of *this interpreter's*
+ * program flags. Any flag at all was too much: `nsenter -t 1 -m sh -c 'sudo id'` puts the
+ * shell after `-m`, which takes no value, and dropping it lost a real elevation. Nothing
+ * here can know an arbitrary tool's grammar, so `sed -n perl -e p` — a shape no one
+ * writes — is still read as a carrier.
+ */
+function isFlagValue(words, i, flags) {
+    if (i === 0)
+        return false;
+    const previous = words[i - 1];
+    return previous.length > 1 && previous.startsWith('-') && flags.includes(previous);
+}
+/**
+ * The program an interpreter was handed on its command line, or null.
+ *
+ * Only flags may sit between the interpreter and its flag; anything else means this was
+ * not that kind of invocation, which is what keeps `python3 script.py` — a program this
+ * cannot read either, but one every deployment runs — out of the gate.
+ */
+function programAfterFlag(words, from, flags) {
+    for (let j = from + 1; j < words.length; j++) {
+        const word = words[j];
+        if (flags.includes(word))
+            return words[j + 1] ?? null;
+        const attached = flags.find((f) => word.startsWith(f) && word.length > f.length);
+        if (attached !== undefined) {
+            const rest = word.slice(attached.length);
+            // `sh -c'sudo id'` tokenises to `-csudo id`, so the program is attached. `bash -cx`
+            // is a flag cluster and the program is the next word. A space, or the `=` of
+            // `--eval=…`, is what tells them apart: a cluster is letters only.
+            if (/\s/.test(rest) || rest.startsWith('='))
+                return rest.replace(/^=/, '');
+            return words[j + 1] ?? null;
+        }
+        // The program flag need not lead the cluster: `bash -xc 'sudo id'` runs exactly what
+        // `bash -cx 'sudo id'` runs, and a prefix test saw the second and missed the first.
+        if (clusterCarriesFlag(word, flags))
+            return words[j + 1] ?? null;
+        if (!word.startsWith('-'))
+            return null;
     }
     return null;
 }
+/**
+ * What follows a short flag inside a single-dash cluster, or null if it holds none.
+ *
+ * Clusters only — a run of single letters after one dash. Long flags and attached values
+ * are handled before this is reached.
+ */
+function clusterCarriesFlag(word, flags) {
+    // Three letters at most. `/^-[A-Za-z]+$/` alone also matches every single-dash long
+    // option, and `find`'s predicates are full of them: `-type` contains perl's `-e`, so
+    // `find . -name perl -type f` read as a carrier and asked for approval.
+    if (!/^-[A-Za-z]{2,3}$/.test(word))
+        return false;
+    const body = word.slice(1);
+    // A cluster is letters only, so whatever follows the program flag is more flags — the
+    // program itself is always the next word.
+    return flags.some((flag) => flag.length === 2 && body.includes(flag[1]));
+}
+/** Spellings of "the program is on standard input" that look like a file operand. */
+const STDIN_PATHS = new Set(['-', '/dev/stdin', '/dev/fd/0', '/proc/self/fd/0']);
+/**
+ * Whether a segment's command word is an interpreter with no program of its own.
+ *
+ * `echo "sudo id" | bash` hands the program over on stdin, where there is nothing to
+ * read. This holds for the shells too — `readable` is about a `-c` argument, and there is
+ * no `-c` here. Requiring that no operand follow is what keeps `cat data | python3
+ * app.py` out of it: there the pipe carries data, not a program.
+ */
+function readsProgramFromStdin(words) {
+    const idx = effectiveCommandIndex(words);
+    if (idx === -1)
+        return false;
+    const bin = stripPath(words[idx]);
+    // Interpreters only. awk's one program-from-stdin form is `awk -f -`, already gated as a
+    // file flag; every other piped awk reads data, not a program.
+    const spec = INTERPRETERS[bin];
+    if (spec === undefined)
+        return false;
+    const flags = spec.flags;
+    let sawStdinFlag = false;
+    for (let j = idx + 1; j < words.length; j++) {
+        const word = words[j];
+        if (flags.some((f) => word === f || word.startsWith(f)))
+            return false;
+        // `--` ends the interpreter's own arguments; what follows is `$1..$n`, so a program
+        // still has to come from somewhere and `bash -s -- arg` reads stdin.
+        // `-s` says outright that the script comes from stdin, so everything after it is
+        // `$1..$n` whatever it looks like.
+        if (word === '-s') {
+            sawStdinFlag = true;
+            continue;
+        }
+        // `--` ends the interpreter's own arguments. Without `-s` the next word is the script
+        // itself, so `bash -- process.sh` reads a file while `bash -s -- arg` reads stdin.
+        if (word === '--') {
+            const next = words[j + 1];
+            return sawStdinFlag || next === undefined || STDIN_PATHS.has(next);
+        }
+        if (STDIN_PATHS.has(word))
+            return true;
+        if (!word.startsWith('-'))
+            return false;
+    }
+    return true;
+}
+/**
+ * Whether any segment hands a program to something this file cannot read.
+ *
+ * Keyed on the segment's command word, never on any word that happens to name an
+ * interpreter: matching a mention rather than an invocation is the defect this file
+ * records fixing as #91, and `cat /usr/bin/python3` names an interpreter without running
+ * one. A program-bearing flag must actually be present, so naming one is not enough.
+ */
+function hasUnreadableProgram(command) {
+    const segments = tokenizeSegmentsDetailed(command);
+    for (let i = 0; i < segments.length; i++) {
+        const { words, sep } = segments[i];
+        if (sep === '|' && readsProgramFromStdin(words))
+            return true;
+        if (!operandsAreData(words)) {
+            for (let j = 0; j < words.length; j++) {
+                const spec = INTERPRETERS[stripPath(unquote(words[j]))];
+                if (spec === undefined || spec.readable)
+                    continue;
+                if (isFlagValue(words, j, spec.flags))
+                    continue;
+                if (programAfterFlag(words, j, spec.flags) !== null)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
 /**
  * Whether any segment runs a command this process cannot name.
  *
@@ -591,49 +983,79 @@ function effectiveCommandWord(words) {
  * promoting that would put a prompt on most ordinary shell usage.
  */
 function hasUnnameableCommand(command) {
-    for (const raw of command.split(/[;&|\n]/)) {
-        const words = raw.trim().split(/\s+/).filter(Boolean);
+    for (const words of tokenizeSegments(command)) {
         const head = effectiveCommandWord(words);
         if (head !== null && /[$`]/.test(head))
             return true;
     }
     return false;
 }
+/**
+ * Commands this server synthesises rather than a user typing them.
+ *
+ * These reach the classifier as text like `sftp:upload /etc/passwd`, and no rule named
+ * them, so every one fell through to the default `safe` — a class the default rules grant
+ * to `operator` on `prod`. Writing an arbitrary file to the target is not `safe`: it is
+ * the same authority as `rm`, spelled through a different tool, and it reaches
+ * `~/.ssh/authorized_keys` without touching a shell. Opening a session is the same
+ * argument, since it hands over an interactive shell.
+ *
+ * `sftp:download` and `session:close` are deliberately absent. Both would move *down*
+ * from `safe` — download to `read-only`, matching its `readOnlyHint`, and close being a
+ * release rather than an acquisition. Lowering a class is a widening, and a security
+ * release is the wrong place for one; they keep the class they have today.
+ */
+const SYNTHETIC_CLASSES = Object.assign(Object.create(null), {
+    'sftp:upload': 'destructive',
+    'session:open': 'destructive',
+});
+/** The first word, tokenised — the synthetic verb when there is one. */
+function syntheticVerb(command) {
+    return tokenizeSegments(command)[0]?.[0] ?? '';
+}
+/**
+ * The class of a command, and of everything it carries.
+ *
+ * A command that carries another decides nothing on its own: the remote shell expands
+ * `$(...)`, backticks, `<(...)` and `sh -c` and runs what is inside, so the class is the
+ * higher of the two. The scan for carriers already existed, but it *replaced* the outer
+ * class instead of raising it, and only when the inner class was above `safe` — so
+ * `sudo sh -c 'rm -rf /etc'` reported the inner `destructive` and lost the outer
+ * `privileged`, which on `prod` is the difference between a prompt and a refusal.
+ * Taking the maximum is what makes the scan unable to lower anything.
+ */
 export function classifyCommand(command, depth = 0) {
     const trimmed = command.trim();
-    const binary = extractBinary(trimmed);
-    const fullCommand = trimmed;
-    // A command that carries another command decides nothing on its own: the remote
-    // shell expands `$(...)`, backticks, `<(...)` and `sh -c` and runs what is inside,
-    // so the class has to be the higher of the two. Before this, the outer command
-    // decided alone and `echo $(sudo id)` was `safe` — a class the default rules grant
-    // on `prod` to `operator` and `admin`, while granting `privileged` there to nobody
-    // at all (GHSA-v8jh-gv7v-3gvq). It also skipped the approval prompt, since only
-    // `destructive` and `privileged` raise one, and the audit record said `safe`.
-    //
-    // Runs before the checks below rather than after, so the class it produces is not
-    // something a later branch can lower.
-    if (depth < MAX_NESTING_DEPTH) {
-        let highest = null;
-        for (const inner of nestedCommands(trimmed)) {
-            const parsed = classifyCommand(inner, depth + 1);
-            if (highest === null || CLASS_RANK[parsed.class] > CLASS_RANK[highest.class]) {
-                highest = parsed;
-            }
-        }
-        // `binary` comes from the inner command deliberately: it is what the audit
-        // record and the refusal message name, and naming the outer `echo` would
-        // describe the wrong process as the one that ran as root.
-        if (highest !== null && CLASS_RANK[highest.class] > CLASS_RANK['safe']) {
-            return { binary: highest.binary, fullCommand, class: highest.class };
-        }
-    }
-    else {
+    const outer = classifyOuter(trimmed);
+    if (depth >= MAX_NESTING_DEPTH) {
         // Nesting this deep is not something an operator writes, and we have stopped
-        // reading. Refusing to guess is the only answer consistent with the rest of
-        // this function.
-        return { binary, fullCommand, class: 'privileged' };
+        // reading. Refusing to guess is the only answer consistent with the rest of this
+        // file.
+        return { binary: outer.binary, fullCommand: trimmed, class: 'privileged' };
+    }
+    let highest = outer;
+    // A floor, not a verdict. Returning the synthetic class outright would put it above
+    // the elevation and never-allowed checks, so `sftp:upload /tmp/x; sudo id` would
+    // record `destructive` where the command is `privileged`.
+    const verb = syntheticVerb(trimmed);
+    const floor = SYNTHETIC_CLASSES[verb];
+    if (floor !== undefined && CLASS_RANK[floor] > CLASS_RANK[highest.class]) {
+        highest = { binary: verb, fullCommand: trimmed, class: floor };
+    }
+    for (const inner of nestedCommands(trimmed)) {
+        const parsed = classifyCommand(inner, depth + 1);
+        // `binary` follows the winning side deliberately: it is what the audit record and
+        // the refusal message name, and naming the outer `echo` would describe the wrong
+        // process as the one that ran as root.
+        if (CLASS_RANK[parsed.class] > CLASS_RANK[highest.class])
+            highest = parsed;
     }
+    return { binary: highest.binary, fullCommand: trimmed, class: highest.class };
+}
+/** The class of the command itself, reading none of what it carries. */
+function classifyOuter(trimmed) {
+    const binary = extractBinary(trimmed);
+    const fullCommand = trimmed;
     // `binary` names the subject of the class. For everything below it is the
     // leading command; here it is the one that runs as root, which are the same
     // thing only when the prefix leads.
@@ -641,7 +1063,7 @@ export function classifyCommand(command, depth = 0) {
     if (elevated !== null) {
         return { binary: elevated, fullCommand, class: 'privileged' };
     }
-    if (isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
+    if (hasUnreadableProgram(trimmed) || isDestructive(trimmed) || hasDisqualifyingArgs(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
     // Below this point every branch assumes the command word names something we
@@ -655,7 +1077,7 @@ export function classifyCommand(command, depth = 0) {
     if (hasUnnameableCommand(trimmed)) {
         return { binary, fullCommand, class: 'destructive' };
     }
-    const twoWordPrefix = fullCommand.split(/\s+/).slice(0, 2).join(' ');
+    const twoWordPrefix = (tokenizeSegments(fullCommand)[0] ?? []).slice(0, 2).join(' ');
     if (READ_ONLY_ALLOWLIST.has(binary) || READ_ONLY_ALLOWLIST.has(twoWordPrefix)) {
         if (SHELL_CONTROL_CHARS.test(trimmed)) {
             return { binary, fullCommand, class: 'safe' };